Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1/executions/:id endpoint in packages/server/src/routes/executions/index.ts lacks the checkAnyPermission() middleware that protects other execution endpoints. Any authenticated user, regardless of assigned permissions, can modify execution state, data, and metadata of any execution in their workspace, enabling privilege escalation and manipulation of workflow execution results. This issue is fixed in 3.1.3.
Published: 2026-08-04
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a missing authorization check on the execution update endpoint, allowing any authenticated user to change the state, data, and metadata of any execution in their workspace. This exposes the system to privilege escalation and the ability to corrupt or manipulate workflow execution results.

Affected Systems

Flowise AI’s Flowise product, versions prior to 3.1.3 are affected; starting with 3.1.3 the issue is fixed.

Risk and Exploitability

The CVSS score is 7.1, indicating a high likelihood of severe impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is authenticated; an attacker only needs valid user credentials within a workspace to exploit the flaw, making the risk high for any organization relying on Flowise for workflow management.

Generated by OpenCVE AI on August 4, 2026 at 20:26 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Flowise to version 3.1.3 or later to apply the fix for the missing permission check.
  • Reconfigure the /api/v1/executions endpoint to enforce proper role‑based access controls and verify that checkAnyPermission middleware is active.
  • Audit existing executions for unauthorized changes during the vulnerability window and restore from backups if discrepancies are found.

Generated by OpenCVE AI on August 4, 2026 at 20:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-fm2f-4339-4p2f Flowise: Missing Authorization on Execution Update Endpoint
History

Tue, 04 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Flowiseai
Flowiseai flowise
Vendors & Products Flowiseai
Flowiseai flowise

Tue, 04 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 04 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Description Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1/executions/:id endpoint in packages/server/src/routes/executions/index.ts lacks the checkAnyPermission() middleware that protects other execution endpoints. Any authenticated user, regardless of assigned permissions, can modify execution state, data, and metadata of any execution in their workspace, enabling privilege escalation and manipulation of workflow execution results. This issue is fixed in 3.1.3.
Title Flowise: Missing Authorization on Execution Update Endpoint
Weaknesses CWE-862
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Flowiseai Flowise
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-04T19:37:54.504Z

Reserved: 2026-08-04T15:24:41.339Z

Link: CVE-2026-70475

cve-icon Vulnrichment

Updated: 2026-08-04T19:37:45.927Z

cve-icon NVD

Status : Received

Published: 2026-08-04T20:16:54.170

Modified: 2026-08-04T20:16:54.170

Link: CVE-2026-70475

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T20:30:05Z

Weaknesses