CVE-2026-69252High· 8.8▾ TwilightFlowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A lo…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
— → 8.8
0.3% → 0.4%
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authenticated API key with unrelated permissions could call GET /api/v1/files to list files under the organization storage root and DELETE /api/v1/files?path=... to delete files belonging to other workspaces in the same organization because getAllFiles and deleteFile used activeOrganizationId and a user-controlled path without restricting access by permissions or activeWorkspaceId. This issue is fixed in version 3.1.3.
flowise < 3.1.3Upgrade past the affected range:
flowise 3.1.3Affected packages:
flowise <= 3.1.2Patched in:
flowise 3.1.3Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-70475Medium· 6.5Flowise is a drag & drop user interface to build a customized large language model flow
CVE-2026-70473High· 8.5Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows
GHSA-8gj2-2cvc-6xx7MediumFlowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials
CVE-2026-70476High· 8.2Flowise is a drag & drop user interface to build a customized large language model flow
CVE-2026-70477Critical· 9.8Flowise is a drag & drop user interface to build a customized large language model flow
CVE-2026-70471Medium· 6.5Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows