Flowise: Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST…
Flowise
More for Flowise RSS feed for Flowise
- Severity
- High, CVSS 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Record
- CVE-2026-71962
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 10, 2026
- Source last modified
- October 24, 2026
Description
Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint that allows unauthenticated attackers to access private files by exploiting the endpoint's inclusion in the global authentication whitelist, which bypasses all session and API key verification. Attackers can supply valid chatflowId, chatId, and fileName identifiers to retrieve files from any chatflow on the instance, including private chatflows belonging to other workspaces or organizations.
Description quoted from the NVD record.
Who is affected
Your organization is affected if it uses Flowise, a tool for building apps that use AI language models, at versions 2.2.4 through 3.1.4. The problem is in the feature that downloads files used by OpenAI assistants, which lets anyone skip the usual login and access key checks. An attacker who has never signed in, and who knows the right identifiers for a chatflow (a chatbot workflow), a chat and a file name, could download files from any chatflow on that installation. This includes private ones belonging to other workspaces or organizations. This flaw is rated High.
What to do
- If you are not sure whether your organization uses Flowise, ask whoever looks after your computers and online tools.
- The person who installed or runs Flowise for your organization should check which version is in use. Versions 2.2.4 through 3.1.4 are affected.
- No fixed version is named for this flaw yet, so check the vendor advisory linked on this page for a fixed release and install it as soon as it is available.
- If an IT provider or vendor runs Flowise for your organization, send them this advisory and ask when the update will be done.
Analysis written from the source record as of October 24, 2026 and reviewed before publishing.