CVE-2026-70475

Flowise: Missing Authorization on Execution Update Endpoint

View on CVE.org
Published Aug 4, 2026 CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1/executions/:id endpoint in packages/server/src/routes/executions/index.ts lacks the checkAnyPermission() middleware that protects other execution endpoints. Any authenticated user, regardless of assigned permissions, can modify execution state, data, and metadata of any execution in their workspace, enabling privilege escalation and manipulation of workflow execution results. This issue is fixed in 3.1.3.

Analysis

AI-generated

Technical impact

The vulnerability is a missing authorization check on the execution update endpoint, allowing any authenticated user to change the state, data, and metadata of any execution in their workspace. This exposes the system to privilege escalation and the ability to corrupt or manipulate workflow execution results.

Affected Systems

Flowise AI’s Flowise product, versions prior to 3.1.3 are affected; starting with 3.1.3 the issue is fixed.

Risk and Exploitability

The CVSS score is 7.1, indicating a high likelihood of severe impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is authenticated; an attacker only needs valid user credentials within a workspace to exploit the flaw, making the risk high for any organization relying on Flowise for workflow management.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Flowise to version 3.1.3 or later to apply the fix for the missing permission check.
  • Reconfigure the /api/v1/executions endpoint to enforce proper role‑based access controls and verify that checkAnyPermission middleware is active.
  • Audit existing executions for unauthorized changes during the vulnerability window and restore from backups if discrepancies are found.

Generated by OpenCVE AI on August 4, 2026 at 20:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-fm2f-4339-4p2f Flowise: Missing Authorization on Execution Update Endpoint
History
Type Values Removed Values Added
CPEs cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'}
Type Values Removed Values Added
First Time appeared Flowiseai
Flowiseai flowise
Vendors & Products Flowiseai
Flowiseai flowise
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1/executions/:id endpoint in packages/server/src/routes/executions/index.ts lacks the checkAnyPermission() middleware that protects other execution endpoints. Any authenticated user, regardless of assigned permissions, can modify execution state, data, and metadata of any execution in their workspace, enabling privilege escalation and manipulation of workflow execution results. This issue is fixed in 3.1.3.
Title Flowise: Missing Authorization on Execution Update Endpoint
Weaknesses CWE-862
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
Aug 4, 2026, 7:37 PM
Reserved
Aug 4, 2026, 3:24 PM

View source JSON

Updated
Aug 4, 2026, 7:37 PM

JSON

Status
Analyzed
Published
Aug 4, 2026, 8:16 PM
Modified
Oct 24, 2026, 3:10 PM

View source JSON

No data.

Updated
Aug 4, 2026, 8:30 PM

JSON