---
id: CVE-2026-67621
title: >-
  Flowise through 3.1.4 contains a missing authorization vulnerability that
  allows authenticated workspace members to perform unauthorized document store
  operations by accessing unprotected mutation endpoints
summary: >-
  Flowise through 3.1.4 contains a missing authorization vulnerability that
  allows authenticated workspace members to perform unauthorized document store
  operations by accessing unprotected mutation endpoints. Attackers holding only
  view-l…
severity: high
cvss: 7.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L'
cwe:
  - CWE-862
vendor: flowiseai
product: flowise
affected:
  - flowise <= 3.1.4
published: '2026-08-06'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T16:08:16.127'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67621'
references:
  - url: 'https://flowiseai.com/sunset'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/Caycon/cve-advisories/blob/main/2026/Flowise/CVE-2026-67621.md
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/flowise-missing-authorization-on-document-store-mutation-endpoints
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00417
epssPercentile: 0.33417
ingestedAt: '2026-09-15T16:40:03.376Z'
---

## Overview

Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers holding only view-level permissions can send direct HTTP requests to the upsert and refresh document store routes to trigger document ingestion, refresh vector database contents, consume embedding API credits, and modify knowledge bases used by downstream chatflows.

## Affected

- `flowise <= 3.1.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.