Flowise: Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated…
Flowise
More for Flowise RSS feed for Flowise
- Severity
- High, CVSS 7.6
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
- Record
- CVE-2026-67621
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 6, 2026
- Source last modified
- October 24, 2026
Description
Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers holding only view-level permissions can send direct HTTP requests to the upsert and refresh document store routes to trigger document ingestion, refresh vector database contents, consume embedding API credits, and modify knowledge bases used by downstream chatflows.
Description quoted from the NVD record.
Who is affected
Flowise is a tool for building apps and chatbots that use AI language models. This flaw affects Flowise versions up to and including 3.1.4. It is in the part of the product that manages document stores, the collections of documents your AI chatbots draw their answers from. A signed-in workspace member who should only be allowed to view these document stores can still make changes to them. That person could load in new documents, refresh their stored contents, use up your paid credits with the AI service that processes documents, and alter the knowledge your chatbots rely on. This flaw is rated High.
What to do
- If someone in your organization installed and runs Flowise, ask that person to check which version is in use. Versions up to and including
3.1.4are affected. - No fixed version is named for this flaw yet, so check the vendor advisory linked on this page for a fixed release and install it as soon as it is available.
- If an IT provider or vendor runs Flowise for your organization, send them this advisory and ask when the update will be done.
Analysis written from the source record as of October 24, 2026 and reviewed before publishing.