CVE-2026-70475
published 2026-08-04CVE-2026-70475: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1/executions/:id endpoint in…
PriorityP344high7.1CVSS 4.0
AVNACLATNPRLUINVCNVIHVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.30%
21.9th percentile
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1/executions/:id endpoint in packages/server/src/routes/executions/index.ts lacks the checkAnyPermission() middleware that protects other execution endpoints. Any authenticated user, regardless of assigned permissions, can modify execution state, data, and metadata of any execution in their workspace, enabling privilege escalation and manipulation of workflow execution results. This issue is fixed in 3.1.3.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| flowiseai | flowise | < 3.1.2 | 3.1.2 |
| flowiseai | flowise | >= 0 < 3.1.3 | 3.1.3 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Flowise: Missing Authorization on Execution Update Endpoint
ghsa·2026-08-04
CVE-2026-70475 [HIGH] CWE-862 Flowise: Missing Authorization on Execution Update Endpoint
Flowise: Missing Authorization on Execution Update Endpoint
# Flowise Security Audit Report
**Date**: 2026-03-17
**Researcher**: Dimpal Jadhav ([email protected])
**GitHub**: https://github.com/Dimpyj1604
**Target**: FlowiseAI/Flowise (latest main branch)
**Version**: [email protected]
### FINDING 1: Missing Authorization on Execution Update Endpoint
**Severity**: HIGH (CVSS ~7.5)
**Type**: CWE-862 (Missing Authorization)
**File**: `packages/server/src/routes/executions/index.ts:11`
**Description**: The `PUT /api/v1/executions/:id` endpoint lacks the `checkAnyPermission()` middleware that protects all other execution endpoints (GET, DELETE). Any authenticated user — regardless of their assigned permissions — can modify any execution record.
**Evidence**:
```typescript
// Lin
VulDB
FlowiseAI Flowise up to 3.1.2 Execution Endpoint index.ts checkAnyPermission permission
vuldb·2026-08-04·CVSS 7.1
CVE-2026-70475 [HIGH] FlowiseAI Flowise up to 3.1.2 Execution Endpoint index.ts checkAnyPermission permission
A vulnerability was found in FlowiseAI Flowise up to 3.1.2 and classified as problematic. Affected is the function checkAnyPermission of the file packages/server/src/routes/executions/index.ts of the component Execution Endpoint. The manipulation results in permission issues.
This vulnerability is identified as CVE-2026-70475. The attack can be executed remotely. There is not any exploit available.
It is suggested to upgrade the affected component.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/FlowiseAI/Flowise/commit/96a9b23b5a103b362a0ee1368d04636755be1bedhttps://github.com/FlowiseAI/Flowise/pull/6409https://github.com/FlowiseAI/Flowise/releases/tag/[email protected]https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-fm2f-4339-4p2fhttps://github.com/FlowiseAI/Flowise/security/advisories/GHSA-fm2f-4339-4p2f
2026-08-04
Published