CVE-2026-70473
published 2026-08-04CVE-2026-70473: Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns…
PriorityP349high8.3CVSS 4.0
AVNACLATNPRLUINVCHVINVALSCHSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.25%
15.8th percentile
Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or workspace. The response can exceed 100MB and includes sensitive configuration data, including Vector Store settings such as Qdrant Server URL and collection name. The observed behavior indicates missing or insufficient authorization checks, workspace/project/tenant isolation, and pagination or limits, exposing integration parameters and infrastructure details that may enable further targeted attacks. This issue is fixed in version 3.1.3.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| flowiseai | flowise | < 3.1.3 | 3.1.3 |
| flowiseai | flowise | >= 0 < 3.1.3 | 3.1.3 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
FlowiseAI Flowise up to 3.1.2 /api/v1/upsert-history improper authorization
vuldb·2026-08-04·CVSS 8.3
CVE-2026-70473 [HIGH] FlowiseAI Flowise up to 3.1.2 /api/v1/upsert-history improper authorization
A vulnerability was found in FlowiseAI Flowise up to 3.1.2. It has been classified as problematic. This affects an unknown part of the file /api/v1/upsert-history. This manipulation causes improper authorization.
This vulnerability is registered as CVE-2026-70473. Remote exploitation of the attack is possible. No exploit is available.
Upgrading the affected component is recommended.
GHSA
Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history
ghsa·2026-08-04
CVE-2026-70473 [HIGH] CWE-200 Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history
Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history
### Summary
The **GET `/api/v1/upsert-history`** endpoint returns the **entire server-wide upsert history** (response size **>100MB**) instead of being scoped to the requesting user/tenant/workspace. The response includes **sensitive configuration data** (e.g., Vector Store settings such as **Qdrant Server URL** and **collection name**), resulting in a **High severity information disclosure** that may enable further targeted attacks.
### Details
- **Affected endpoint:** `GET /api/v1/upsert-history`
- **Observed behavior:** The API returns **global upsert history for the whole server**, indicating missing/insufficient:
- Authorization checks (RBAC/user-based access control)
- Data s
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/FlowiseAI/Flowise/commit/d81483b70c997ddf981acc9c49fbd9a02fa345cdhttps://github.com/FlowiseAI/Flowise/pull/6170https://github.com/FlowiseAI/Flowise/releases/tag/[email protected]https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-fr6g-7cq8-fg82https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-fr6g-7cq8-fg82
2026-08-04
Published