---
id: CVE-2026-69262
title: >-
  Flowise is a drag & drop user interface to build a customized large language
  model flow
summary: >-
  Flowise is a drag & drop user interface to build a customized large language
  model flow. Prior to 3.1.3, `DELETE /api/v1/chatflows/:id` authorized requests
  with checkAnyPermission('chatflows:delete,agentflows:delete'), so possession
  of e…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'
cwe:
  - CWE-863
vendor: flowiseai
product: flowise
affected:
  - flowise < 3.1.3
patched:
  - flowise 3.1.3
published: '2026-08-04'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T19:41:55.683'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-69262'
references:
  - url: >-
      https://github.com/FlowiseAI/Flowise/commit/2f528ceced74afaa95fc7a282965e7788796448b
    label: security-advisories@github.com
  - url: 'https://github.com/FlowiseAI/Flowise/pull/6445'
    label: security-advisories@github.com
  - url: 'https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3'
    label: security-advisories@github.com
  - url: >-
      https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-p5w8-m249-4r4v
    label: security-advisories@github.com
  - url: >-
      https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-p5w8-m249-4r4v
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-p5w8-m249-4r4v'
tags:
  - nvd
  - ghsa
  - npm
epss: 0.00316
epssPercentile: 0.24773
aliases:
  - GHSA-p5w8-m249-4r4v
ecosystem: npm
ingestedAt: '2026-08-04T17:40:54.235Z'
---

## Overview

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, `DELETE /api/v1/chatflows/:id` authorized requests with checkAnyPermission('chatflows:delete,agentflows:delete'), so possession of either permission was sufficient to reach the delete path. The delete logic then resolved the target record only by id and workspaceId and did not validate the target resource type, allowing a caller with only agentflows:delete to delete a CHATFLOW and a caller with only chatflows:delete to delete an AGENTFLOW in the same workspace. This issue is fixed in version 3.1.3.

## Affected

- `flowise < 3.1.3`

## Remediation

Upgrade past the affected range:

- `flowise 3.1.3`

## Package advisory (CVE-2026-69262)

Affected packages:

- `flowise <= 3.1.2`

Patched in:

- `flowise 3.1.3`

Source: https://github.com/advisories/GHSA-p5w8-m249-4r4v