CVE-2026-70476 Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, several organization billing endpoints in packages/server/src/enterprise/routes/organization.route.ts and packages/server/src/enterprise/controllers/organization.controller.ts accept...

CVE-2026-70476 Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, several organization billing endpoints in packages/server/src/enterprise/routes/organization.route.ts and packages/server/src/enterprise/controllers/organization.controller.ts accept...

CVE-2026-70476

Flowise (drag‑and‑drop UI for building LLM flows) has a Broken Access Control in Stripe subscription endpoints. Prior to version 3.1.3, endpoints in packages/server/src/enterprise/routes/organization.route.ts and packages/server/src/enterprise/controllers/organization.controller.ts accepted attac...

CVE-2026-70476

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, several organization billing endpoints in packages/server/src/enterprise/routes/organization.route.ts and packages/server/src/enterprise/controllers/organization.controller.ts accept...

GHSA-FM2F-4339-4P2F Flowise: Missing Authorization on Execution Update Endpoint

Flowise Security Audit Report Date: 2026-03-17 Researcher: Dimpal Jadhav [email protected] GitHub: https://github.com/Dimpyj1604 Target: FlowiseAI/Flowise latest main branch Version: [email protected] FINDING 1: Missing Authorization on Execution Update Endpoint Severity: HIGH CVSS 7.5...

CVE-2026-70475

Flowise user interface (Flowise) is affected by a vulnerability in the PUT /api/v1/executions/:id endpoint prior to version 3.1.3. The endpoint lacked the checkAnyPermission() middleware that protects other execution endpoints, allowing any authenticated user to modify execution state, data, and ...

CVE-2026-70475 Flowise: Missing Authorization on Execution Update Endpoint

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1/executions/:id endpoint in packages/server/src/routes/executions/index.ts lacks the checkAnyPermission middleware that protects other execution endpoints. Any authenticated use...

CVE-2026-70473

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or workspace. The response can exceed 100MB an...

CVE-2026-70474

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise has three OAuth2 credential endpoints that look up credentials by id alone with no workspaceId filter. The authorize, callback, and refresh handlers query the Credential table...

CVE-2026-70471

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise injects $vars into the code execution sandbox without requiring variables:view, bypassing the permission-protected Variables API. Variables for the active workspace are fetche...

CVE-2026-69264

creationtimestamp| type| source ---|---|--- 2026-08-04 18:35:05+00:00| published-proof-of-concept| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-4j8x-x6v7-w9rq 2026-08-04 19:14:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msbpuojef22m 2026-08-06...

CVE-2026-70470

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide...

CVE-2026-69264

Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import,...

CVE-2026-69259

creationtimestamp| type| source ---|---|--- 2026-08-04 18:14:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msbmjgbfph2b 2026-08-04 18:35:12+00:00| published-proof-of-concept| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x3hf-7cj6-3r4m 2026-08-06...

NPM: Flowise: Cross-Workspace OAuth2 Credential Metadata Leak

NPM: Flowise: Cross-Workspace OAuth2 Credential Metadata Leak vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

CVE-2026-70474 Flowise: Cross-Workspace OAuth2 Credential Metadata Leak

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise has three OAuth2 credential endpoints that look up credentials by id alone with no workspaceId filter. The authorize, callback, and refresh handlers query the Credential table...

CVE-2026-70474 Flowise: Cross-Workspace OAuth2 Credential Metadata Leak

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise has three OAuth2 credential endpoints that look up credentials by id alone with no workspaceId filter. The authorize, callback, and refresh handlers query the Credential table...

CVE-2026-70474

Flowise (flows builder UI) has a cross-workspace OAuth2 credential metadata leak prior to version 3.1.3. Three OAuth2 credential endpoints—/api/v1/oauth2-credential/authorize/, /api/v1/oauth2-credential/callback?code=ATTACKER_AUTH_CODE&state=, and /api/v1/oauth2-credential/refresh/—query the Cred...

CVE-2026-70474

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise has three OAuth2 credential endpoints that look up credentials by id alone with no workspaceId filter. The authorize, callback, and refresh handlers query the Credential table...

NPM: Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

NPM: Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...