Flow-Like EUVD-2026-62589

Exploitation requires four concurrent conditions: (1) the target deployment is self-hosted Flow-Like using Azure Blob Storage as the storage backend - AWS-backed deployments are architecturally not affected; (2) the attacker is an authenticated member of the targeted application instance; (3) the attacker holds the ExecuteEvents permission but lacks both ReadFiles and WriteFiles permissions - this specific permission gap is what triggers the InvokeNone credential path that still mints the overprivileged SAS token; (4) the deployment runs a version prior to 1.0.4. Limiting factors: authentication is mandatory (CVSS PR:L confirms authenticated exploitation only), the attacker must be an existing member of the specific app being targeted (cross-app exploitation is not described), and the SAS token scope is limited to the apps/{app_id} blob prefix rather than the entire Azure storage account or other apps.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N, score 7.2) accurately characterizes the threat: network-accessible, no special attack conditions, requires only low privilege (app membership with ExecuteEvents), and produces high integrity impact via unrestricted blob write and delete. EPSS data is not available for this CVE, and it is not listed in CISA KEV, indicating no confirmed widespread or active exploitation at time of analysis. The real-world priority is therefore deployment-conditional - organizations running self-hosted Flow-Like with Azure Blob Storage should treat this as high priority, while hosted deployments need take no action. The threat actor profile is a malicious or compromised app member (insider threat) rather than an external unauthenticated attacker, which reduces but does not eliminate urgency. The blast radius is bounded to the apps/{app_id} blob prefix rather than the full storage account, limiting lateral movement within Azure storage. No conflicting signals between CVSS metrics and the description were identified.

An authenticated app member who has been granted ExecuteEvents (to trigger workflows) but explicitly denied ReadFiles and WriteFiles issues a single GET request to /api/v1/apps/{target_app_id}/invoke/presign. The server returns a JSON response containing a SAS token with sp=rwdl scoped to the target app's blob prefix. The attacker uses this token directly with the Azure Blob Storage REST API or SDK to overwrite application artifacts, inject malicious content, or delete blobs - bypassing all application-layer file permission controls without any public exploit code required.