{"id":"CVE-2026-70478","title":"Flowise is a drag & drop user interface to build a customized large language model flow","summary":"Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint is included in WHITELIST_URLS and requires no authentication. The …","severity":"critical","cvss":10,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-200"],"vendor":"flowiseai","product":"flowise","affected":["flowise < 3.1.3"],"patched":["flowise 3.1.3"],"published":"2026-08-04","updated":"2026-09-11","sourceUpdated":"2026-09-11T21:14:26.357","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70478","references":[{"url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-qgvm-j2hm-6m38","label":"security-advisories@github.com"},{"url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-qgvm-j2hm-6m38","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-qgvm-j2hm-6m38"}],"tags":["nvd","ghsa","npm"],"epss":0.00534,"epssPercentile":0.43855,"aliases":["GHSA-qgvm-j2hm-6m38"],"ecosystem":"npm","ingestedAt":"2026-08-04T19:41:28.858Z","slug":"CVE-2026-70478","body":"## Overview\n\nFlowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint is included in WHITELIST_URLS and requires no authentication. The endpoint decrypts the stored credential, sends a refresh request to the configured OAuth provider with the client secret and refresh token, and returns the refreshed access_token in the response body. An attacker with a credential ID can use the token to access the victim's connected service and can also exhaust refresh-token quota. This issue is fixed in 3.1.3.\n\n## Affected\n\n- `flowise < 3.1.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `flowise 3.1.3`\n\n## Package advisory (CVE-2026-70478)\n\nAffected packages:\n\n- `flowise <= 3.1.2`\n\nPatched in:\n\n- `flowise 3.1.3`\n\nSource: https://github.com/advisories/GHSA-qgvm-j2hm-6m38","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":55,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201882,"id":"CVE-2026-70478","ts":1789399966676,"field":"cvss","old":null,"new":"10"},{"seq":200612,"id":"CVE-2026-70478","ts":1789397481203,"field":"cvss","old":"10","new":null},{"seq":199328,"id":"CVE-2026-70478","ts":1789395440388,"field":"cvss","old":null,"new":"10"},{"seq":198573,"id":"CVE-2026-70478","ts":1789392111290,"field":"cvss","old":"10","new":null},{"seq":198528,"id":"CVE-2026-70478","ts":1789392059182,"field":"cvss","old":null,"new":"10"},{"seq":196319,"id":"CVE-2026-70478","ts":1789383684275,"field":"cvss","old":"10","new":null},{"seq":195248,"id":"CVE-2026-70478","ts":1789380533449,"field":"cvss","old":null,"new":"10"},{"seq":194035,"id":"CVE-2026-70478","ts":1789378627598,"field":"cvss","old":"10","new":null},{"seq":192822,"id":"CVE-2026-70478","ts":1789376462708,"field":"cvss","old":null,"new":"10"},{"seq":191609,"id":"CVE-2026-70478","ts":1789373536400,"field":"cvss","old":"10","new":null},{"seq":190394,"id":"CVE-2026-70478","ts":1789369412268,"field":"cvss","old":null,"new":"10"},{"seq":189181,"id":"CVE-2026-70478","ts":1789368328448,"field":"cvss","old":"10","new":null},{"seq":187964,"id":"CVE-2026-70478","ts":1789365196586,"field":"cvss","old":null,"new":"10"},{"seq":186751,"id":"CVE-2026-70478","ts":1789363398955,"field":"cvss","old":"10","new":null},{"seq":185537,"id":"CVE-2026-70478","ts":1789361178769,"field":"cvss","old":null,"new":"10"},{"seq":184324,"id":"CVE-2026-70478","ts":1789358256908,"field":"cvss","old":"10","new":null},{"seq":182575,"id":"CVE-2026-70478","ts":1789354271946,"field":"cvss","old":null,"new":"10"},{"seq":181368,"id":"CVE-2026-70478","ts":1789353229164,"field":"cvss","old":"10","new":null},{"seq":180161,"id":"CVE-2026-70478","ts":1789350222605,"field":"cvss","old":null,"new":"10"},{"seq":178954,"id":"CVE-2026-70478","ts":1789348200134,"field":"cvss","old":"10","new":null},{"seq":177747,"id":"CVE-2026-70478","ts":1789346328482,"field":"cvss","old":null,"new":"10"},{"seq":176540,"id":"CVE-2026-70478","ts":1789343113782,"field":"cvss","old":"10","new":null},{"seq":174657,"id":"CVE-2026-70478","ts":1789334836860,"field":"cvss","old":null,"new":"10"},{"seq":173452,"id":"CVE-2026-70478","ts":1789333604983,"field":"cvss","old":"10","new":null},{"seq":172266,"id":"CVE-2026-70478","ts":1789331052614,"field":"cvss","old":null,"new":"10"},{"seq":171080,"id":"CVE-2026-70478","ts":1789328698549,"field":"cvss","old":"10","new":null},{"seq":169875,"id":"CVE-2026-70478","ts":1789327123410,"field":"cvss","old":null,"new":"10"},{"seq":168670,"id":"CVE-2026-70478","ts":1789323763247,"field":"cvss","old":"10","new":null},{"seq":167465,"id":"CVE-2026-70478","ts":1789319647456,"field":"cvss","old":null,"new":"10"},{"seq":166260,"id":"CVE-2026-70478","ts":1789318654363,"field":"cvss","old":"10","new":null},{"seq":165055,"id":"CVE-2026-70478","ts":1789315755679,"field":"cvss","old":null,"new":"10"},{"seq":163850,"id":"CVE-2026-70478","ts":1789313556727,"field":"cvss","old":"10","new":null},{"seq":162645,"id":"CVE-2026-70478","ts":1789311866915,"field":"cvss","old":null,"new":"10"},{"seq":161440,"id":"CVE-2026-70478","ts":1789308622628,"field":"cvss","old":"10","new":null},{"seq":160966,"id":"CVE-2026-70478","ts":1789307902143,"field":"cvss","old":null,"new":"10"},{"seq":160492,"id":"CVE-2026-70478","ts":1789304083852,"field":"cvss","old":"10","new":null},{"seq":159553,"id":"CVE-2026-70478","ts":1789300439163,"field":"cvss","old":null,"new":"10"},{"seq":156542,"id":"CVE-2026-70478","ts":1789294684832,"field":"cvss","old":"10","new":null},{"seq":155337,"id":"CVE-2026-70478","ts":1789292862260,"field":"cvss","old":null,"new":"10"},{"seq":154132,"id":"CVE-2026-70478","ts":1789289708411,"field":"cvss","old":"10","new":null},{"seq":152782,"id":"CVE-2026-70478","ts":1789281617395,"field":"cvss","old":null,"new":"10"},{"seq":152422,"id":"CVE-2026-70478","ts":1789281199651,"field":"cvss","old":"10","new":null},{"seq":151383,"id":"CVE-2026-70478","ts":1789277583022,"field":"cvss","old":null,"new":"10"},{"seq":150344,"id":"CVE-2026-70478","ts":1789276187457,"field":"cvss","old":"10","new":null},{"seq":149311,"id":"CVE-2026-70478","ts":1789273789440,"field":"cvss","old":null,"new":"10"},{"seq":148278,"id":"CVE-2026-70478","ts":1789271256815,"field":"cvss","old":"10","new":null},{"seq":146310,"id":"CVE-2026-70478","ts":1789269331487,"field":"cvss","old":null,"new":"10"},{"seq":145115,"id":"CVE-2026-70478","ts":1789266282260,"field":"cvss","old":"10","new":null},{"seq":144019,"id":"CVE-2026-70478","ts":1789262572025,"field":"cvss","old":null,"new":"10"},{"seq":142923,"id":"CVE-2026-70478","ts":1789261452306,"field":"cvss","old":"10","new":null}]}