EUVD-2026-54169
GHSA-7q53-9j99-gg5c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoints require only low-privilege workspace membership; high integrity impact from unrestricted vector store writes; low confidentiality and availability from potential data exposure and API credit exhaustion.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers holding only view-level permissions can send direct HTTP requests to the upsert and refresh document store routes to trigger document ingestion, refresh vector database contents, consume embedding API credits, and modify knowledge bases used by downstream chatflows.
AnalysisAI
Flowise through version 3.1.4 exposes document store mutation endpoints without enforcing authorization, allowing authenticated workspace members holding only view-level permissions to directly invoke upsert and refresh routes that should be restricted to higher-privileged roles. The missing server-side authorization check (CWE-862) enables a malicious insider or compromised view-only account to inject or overwrite vector database contents, trigger costly embedding API credit consumption, and corrupt knowledge bases that power downstream AI chatflows - without any UI-layer interaction. No public exploit has been identified at time of analysis, though the exploitation path is low-complexity given direct HTTP access suffices, and a disclosure advisory is publicly available on GitHub.
Technical ContextAI
Flowise is an open-source, low-code platform for constructing LLM-orchestration pipelines and retrieval-augmented generation (RAG) workflows. Its document store subsystem manages ingestion of documents into vector databases, which are queried at inference time by downstream chatflows. The flaw (CWE-862: Missing Authorization) is in the mutation layer of this subsystem: the API routes handling upsert (document ingestion into the vector store) and refresh (reprocessing and re-embedding stored documents) perform no server-side permission check beyond confirming the caller is an authenticated workspace member. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L confirms network-accessible endpoints with low privilege and no attack requirements. In a correctly implemented RBAC system, write operations on the document store would be gated on a higher permission tier than the view role; here, authentication and authorization are conflated, leaving mutation endpoints effectively open to any workspace member.
RemediationAI
Upgrade Flowise to a version beyond 3.1.4 that addresses this authorization gap; however, no specific patched release version was confirmed from the available input data - verify the current release on the official Flowise GitHub repository before upgrading. Given the reference to https://flowiseai.com/sunset potentially signaling end-of-life status, organizations should assess whether continued operation of Flowise is appropriate or whether migration to a supported LLM workflow platform is warranted. As immediate compensating controls: restrict access to document store mutation routes (e.g., /api/v1/document-store/upsert and equivalent refresh endpoints) at the API gateway or reverse proxy layer to only trusted administrator IP ranges - this prevents exploitation with no application-layer change but requires correct network topology. Additionally, audit all workspace members and revoke view-only access for untrusted or unnecessary accounts to reduce the pool of potential exploiters. Monitor embedding API usage logs for unexpected ingestion volume spikes, which may indicate unauthorized calls. Advisory: https://github.com/Caycon/cve-advisories/blob/main/2026/Flowise/CVE-2026-67621.md.
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Flowise versions before 3.0.1 allow unauthenticated access to the Custom MCPs feature, which is designed to execute OS c
FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. Una
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Flowise is a drag & drop user interface to build a customized large language model flow. Rated critical severity (CVSS 9
Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthent
Missing authentication on NVD data endpoint in Flowise before 3.0.13 allows unauthenticated access to internal vulnerabi
Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDat
Remote code execution in FlowiseAI Flowise before 3.1.3 lets an attacker execute arbitrary OS commands as the Flowise pr
Remote command execution in Flowise <= 3.1.2 lets an authenticated user break out of the vm2/@flowiseai/nodevm JavaScrip
Arbitrary file read and write in FlowiseAI Flowise (versions 2.2.8 through 3.0.5) lets remote unauthenticated attackers
Authenticated remote code execution in FlowiseAI Flowise prior to 3.1.2 allows any user with a valid session or API key
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today