---
id: CVE-2026-50173
title: Flow-Like is a platform for building end-to-end use cases
summary: >-
  Flow-Like is a platform for building end-to-end use cases. Prior to version
  1.0.4, `GET /api/v1/apps/{app_id}/invoke/presign` grants Azure Blob Storage
  SAS credentials with write and delete access to app content to any app member
  that ha…
severity: none
cwe:
  - CWE-863
published: '2026-08-19'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T20:09:01.757'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-50173'
references:
  - url: >-
      https://github.com/Rheosoph/flow-like/security/advisories/GHSA-99w9-5gvv-4v78
    label: security-advisories@github.com
  - url: >-
      https://github.com/Rheosoph/flow-like/security/advisories/GHSA-99w9-5gvv-4v78
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00679
epssPercentile: 0.50321
ingestedAt: '2026-09-18T20:51:25.639Z'
---

## Overview

Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, `GET /api/v1/apps/{app_id}/invoke/presign` grants Azure Blob Storage SAS credentials with write and delete access to app content to any app member that has `ExecuteEvents`, even when that member lacks `ReadFiles` and `WriteFiles`. The route treats file permissions as optional after the `ExecuteEvents` gate. When the caller has neither file permission, it selects `CredentialsAccess::InvokeNone`. In the Azure credential provider, `InvokeNone` still mints a `content_sas_token` for `apps/{app_id}` with `sp=rwdl`, plus user-content and log SAS tokens. The returned shared credential is enough for the low-privilege caller to directly write or delete blobs under the app content prefix. Version 1.0.4 patches the issue. Flow-Like Studio and the hosted Flow-Like Web App are not affected. These deployments use AWS-backed storage. Self-hosted deployments are only affected if they use Azure Blob Storage as the storage backend. In affected deployments, the issue only applies to authenticated app members who have workflow execution permissions but should not have app file write/delete permissions. Users of affected self-hosted Azure deployments should update to version 1.0.4 or the latest dev branch.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.