Technical impact
A misimplemented delete authorization in Flowise allows a user who has delete permission on either chatflows or agentflows to delete a flow of the other type. The invariant delete endpoint checks only whether the caller has any of the permissions chatflows:delete or agentflows:delete, but the delete logic resolves the target record solely by its id and the workspace identifier, without validating the resource type. As a result, a user possessing only agentflows:delete can delete a CHATFLOW and vice versa. This flaw permits intentional data loss or disruption of services that rely on the integrity of these flows.
Affected Systems
The vulnerability is present in Flowise versions prior to 3.1.3, particularly any Flowise deployment from FlowiseAI : Flowise up to v3.1.2 inclusive. All users within a workspace who are granted the delete permission on either flow type are potentially affected.
Risk and Exploitability
With a CVSS score of 7.1, the vulnerability represents a high‑severity threat. The EPSS score is not provided, and the issue is not listed in the CISA KEV catalog. Exploitation requires authenticated access to the Flowise API with either chatflows:delete or agentflows:delete permission, and the attacker can delete a flow belonging to the other type within the same workspace, causing accidental or malicious data loss and potential service disruptions. The risk is amplified in environments where users or services have broad delete permissions across flow types, or where multiple teams share workspaces.
Github GHSA