PT-2026-67919

Flowise Security Audit Report Date: 2026-03-17 Researcher: Dimpal Jadhav [email protected] GitHub: https://github.com/Dimpyj1604 Target: FlowiseAI/Flowise latest main branch Version: [email protected] FINDING 1: Missing Authorization on Execution Update Endpoint Severity: HIGH CVSS 7.5...

CVE-2026-69252: Missing Authorization

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authenticated API key with unrelated permission...

PT-2026-67902

Summary A user granted write access to a shared chat folder could permanently delete chats and messages belonging to the folder's owner. Deleting a folder cascades into the owner's chats and the entire subfolder subtree, and the deletion handler required only write access on subfolders instead of...

PT-2026-67821

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description An authorization flaw exists where the 'PUT /api/v1/executions/:id' endpoint lacks the checkAnyPermission middleware used to protect other execution endpoints. This allows any authenticated user,...

PT-2026-67778

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description An authorization bypass exists in the DELETE /api/v1/chatflows/:id endpoint. The system uses the checkAnyPermission'chatflows:delete,agentflows:delete' function, which allows access if the user...

PT-2026-67906

Summary Flowise's CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis which on Node.js exposes eval and dynamic import, the...

PT-2026-67904

Summary DELETE /api/v1/chats/id cancelled a chat's in-flight tasks before it checked whether the caller was allowed to delete that chat. Any authenticated user who knew another user's chat id could therefore abort that user's running model response, title generation or tag generation. The deletio...

CVE-2026-69250: Authorization Bypass Through User-Controlled Key

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is unauthenticated by design and performs a server-side HTTP request to the credential-controlled...

PT-2026-67920

Summary The GET /api/v1/upsert-history endpoint returns the entire server-wide upsert history response size 100MB instead of being scoped to the requesting user/tenant/workspace. The response includes sensitive configuration data e.g., Vector Store settings such as Qdrant Server URL and collectio...

PT-2026-67928

summary: In Flowise, DELETE /api/v1/chatflows/:id authorizes requests with checkAnyPermission'chatflows:delete,agentflows:delete'. Possession of either permission is sufficient to reach the delete path. The delete logic does not validate the target resource type, allowing a caller with only...

PT-2026-67810

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description Flowise injects $vars into the code execution sandbox without requiring the variables:view permission, which bypasses the permission-protected Variables API. An unauthorized user or API key denied...

CVE-2026-69258: Authorization Bypass Through User-Controlled Key

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the unauthenticated POST /api/v1/prediction/:id endpoint accepted an overrideConfig object and unconditionally spread it into internal flowConfig and flowData objects in...

CVE-2026-70475: Missing Authorization

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1/executions/:id endpoint in packages/server/src/routes/executions/index.ts lacks the checkAnyPermission middleware that protects other execution endpoints. Any authenticated use...

CVE-2026-70473: Exposure of Sensitive Information to an Unauthorized Actor

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or workspace. The response can exceed 100MB an...

CVE-2026-69262: Incorrect Authorization

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, DELETE /api/v1/chatflows/:id authorized requests with checkAnyPermission'chatflows:delete,agentflows:delete', so possession of either permission was sufficient to reach the delete path. The...

CVE-2026-70478: Exposure of Sensitive Information to an Unauthorized Actor

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint is included in WHITELISTURLS and requires no authentication. The endpoint decrypts the stored credential, sends a refresh...

PT-2026-67812

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description Flowise is a drag-and-drop user interface for building customized large language model LLM flows. The GET /api/v1/upsert-history endpoint returns the entire server-wide upsert history instead of...

CVE-2026-70494: Missing Authorization

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, the DELETE /api/v1/folders/id handler in backend/openwebui/routers/folders.py allowed a user granted write access to a shared chat folder to permanently delete chats and messages...

PT-2026-67862

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.10.0 through 0.10.9 Description A flaw in the DELETE /api/v1/folders/id endpoint allows a user with write access to a shared chat folder to permanently delete chats and messages belonging to the folder owner. This occurs...

PT-2026-67836

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.6 through 0.10.2 Description An issue exists where the DELETE /api/v1/chats/id endpoint cancels in-flight tasks before verifying if the caller has the necessary permissions to delete the chat. An authenticated user who...