CVE-2026-71962

Flowise versions 2.2.4 through 3.1.4 expose a missing authorization vulnerability in POST /api/v1/openai-assistants-file/download. An unauthenticated attacker can bypass the global authentication whitelist to bypass session and API key verification and retrieve private files by supplying valid ch...