CVE-2026-69262

creationtimestamp| type| source ---|---|--- 2026-08-04 17:31:02+00:00| seen| https://gist.github.com/alon710/3c340657379dfd929a73082180747c70 2026-08-06 20:45:34+00:00| seen| https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-per-flowise...

CVE-2026-69262

Flowise prior to 3.1.3 has an access control flaw in DELETE /api/v1/chatflows/:id: possession of either chatflows:delete or agentflows:delete allowed access to the delete path, but the target resource type was not validated. The delete logic resolved the record only by id and workspaceId, permitt...

CVE-2026-69262 Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow type

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, DELETE /api/v1/chatflows/:id authorized requests with checkAnyPermission'chatflows:delete,agentflows:delete', so possession of either permission was sufficient to reach the delete path. The...