Flowise EUVD-2026-55702

The POST /api/v1/openai-assistants-file/download endpoint must be network-reachable - the default posture for internet-deployed Flowise instances. The attacker must supply valid chatflowId, chatId, and fileName parameter values; these may be enumerable through other API endpoints, disclosed in application logs, or derivable from prior access. No authentication, session token, API key, or privileged role is required - the endpoint is unconditionally excluded from the application's authentication middleware for all Flowise 2.2.4-3.1.4 deployments. Exploitation is limited to file read (confidentiality impact only); no write, delete, or denial-of-service capability is conferred by this flaw alone. Instances placed behind a VPN, authenticating proxy, or with the endpoint blocked at the network layer are not exploitable via this path.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) accurately reflects the severity: the endpoint is fully unauthenticated, requires no attack complexity, and produces high confidentiality impact. A public PoC is confirmed on GitHub, materially lowering the exploitation barrier and making this an active priority rather than a theoretical concern. EPSS data was not included in the provided intelligence, but the combination of a trivially exploitable unauthenticated network vector, a published PoC, and a commonly internet-exposed deployment posture points to high real-world exploitation probability. The vulnerability is not yet listed in CISA KEV, so active exploitation has not been formally confirmed, though the gap between PoC availability and KEV listing is historically short for high-impact, unauthenticated flaws. Risk is highest for shared or multi-tenant Flowise instances exposed to the internet; single-tenant deployments behind a VPN or authenticating proxy face substantially lower risk. The vendor advisory URL (flowiseai.com/sunset) warrants close review - the 'sunset' path may indicate end-of-life status for the product, which if confirmed would make a vendor-issued patch unlikely and would elevate the urgency of compensating controls significantly.

An attacker identifies an internet-facing Flowise instance and uses the published PoC (GitHub gist by haidang-infosec) to send a crafted POST request to /api/v1/openai-assistants-file/download with enumerated or previously leaked chatflowId, chatId, and fileName values. The application's middleware unconditionally skips authentication for that route, returning the requested file directly - enabling the attacker to download documents from private chatflows belonging to other organizations on the same instance without ever authenticating.