Flowise, a visual LLM flow builder, had a flaw in its GET /api/v1/upsert-history endpoint that returned the entire server‑wide upsert history rather than limiting it to the requesting user, tenant, or workspace. Because this endpoint exposed configuration information—including vector store URLs and collection names—the response could be more than 100 MB, revealing sensitive infrastructure details. The flaw is due to missing or insufficient authorization checks, lack of isolation between workspaces, and no pagination or size limits, making the data susceptible to exposure. Attackers who can authenticate to Flowise could therefore obtain confidential settings that might support further attacks.

The vulnerability affects all FlowiseAI releases before 3.1.3. The fix is delivered in Flowise 3.1.3, which scopes the upsert history to the appropriate user context and adds pagination or limits. No specific patch version range is provided beyond the stable 3.1.3 release.

The CVSS score of 8.3 indicates a high severity information‑disclosure risk. EPSS is not available, so the current exploitation probability is unknown, but the lack of access controls means any authenticated user can exploit it. The variant is not listed in the CISA KEV catalog. The likely attack vector is an authenticated API call to /api/v1/upsert-history; once exploited, the attacker gains a dump of server‑wide configuration data which could enable lateral movement or privileged operations on the underlying infrastructure.