EUVD-2026-62589Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low privilege required (authenticated app member with ExecuteEvents); integrity high from unrestricted blob write and delete; no scope change as impact is bounded to the app storage prefix.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, GET /api/v1/apps/{app_id}/invoke/presign grants Azure Blob Storage SAS credentials with write and delete access to app content to any app member that has ExecuteEvents, even when that member lacks ReadFiles and WriteFiles. The route treats file permissions as optional after the ExecuteEvents gate. When the caller has neither file permission, it selects CredentialsAccess::InvokeNone. In the Azure credential provider, InvokeNone still mints a content_sas_token for apps/{app_id} with sp=rwdl, plus user-content and log SAS tokens. The returned shared credential is enough for the low-privilege caller to directly write or delete blobs under the app content prefix. Version 1.0.4 patches the issue. Flow-Like Studio and the hosted Flow-Like Web App are not affected. These deployments use AWS-backed storage. Self-hosted deployments are only affected if they use Azure Blob Storage as the storage backend. In affected deployments, the issue only applies to authenticated app members who have workflow execution permissions but should not have app file write/delete permissions. Users of affected self-hosted Azure deployments should update to version 1.0.4 or the latest dev branch.
AnalysisAI
Broken authorization in Flow-Like's Azure presign endpoint allows authenticated app members holding only ExecuteEvents permission to obtain Azure Blob Storage SAS tokens with read, write, delete, and list (sp=rwdl) access to application content - permissions they explicitly should not possess. Only self-hosted Flow-Like deployments prior to version 1.0.4 using Azure Blob Storage are affected; the vendor's hosted services (Flow-Like Studio and the hosted Web App, both AWS-backed) are explicitly excluded. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires four concurrent conditions: (1) the target deployment is self-hosted Flow-Like using Azure Blob Storage as the storage backend - AWS-backed deployments are architecturally not affected; (2) the attacker is an authenticated member of the targeted application instance; (3) the attacker holds the `ExecuteEvents` permission but lacks both `ReadFiles` and `WriteFiles` permissions - this specific permission gap is what triggers the `InvokeNone` credential path that still mints the overprivileged SAS token; (4) the deployment runs a version prior to 1.0.4. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N, score 7.2) accurately characterizes the threat: network-accessible, no special attack conditions, requires only low privilege (app membership with `ExecuteEvents`), and produces high integrity impact via unrestricted blob write and delete. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade self-hosted Flow-Like deployments to version 1.0.4 or the latest dev branch, as confirmed by the vendor advisory at https://github.com/Rheosoph/flow-like/security/advisories/GHSA-99w9-5gvv-4v78. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all self-hosted Flow-Like instances and identify those running versions earlier than 1.0.4 with Azure Blob Storage backends; immediately audit and restrict Azure Blob Storage access to only the Flow-Like service identity using Azure RBAC. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today