CVE-2026-70473High· 8.5▾ TwilightFlowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requestin…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 46.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
0.2% → 0.3%
8.5 → —
— → 8.5
8.5 → —
— → 8.5
8.5 → —
— → 8.5
8.5 → —
— → 8.5
8.5 → —
— → 8.5
8.5 → —
— → 8.5
Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or workspace. The response can exceed 100MB and includes sensitive configuration data, including Vector Store settings such as Qdrant Server URL and collection name. The observed behavior indicates missing or insufficient authorization checks, workspace/project/tenant isolation, and pagination or limits, exposing integration parameters and infrastructure details that may enable further targeted attacks. This issue is fixed in version 3.1.3.
flowise < 3.1.3Upgrade past the affected range:
flowise 3.1.3Affected packages:
flowise <= 3.1.2Patched in:
flowise 3.1.3Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-70472High· 8.8Flowise is a drag & drop user interface to build a customized large language model flow
CVE-2026-70475Medium· 6.5Flowise is a drag & drop user interface to build a customized large language model flow
GHSA-rwrp-9823-p2xqMedium· 6.5Flowise: Incomplete Credential Redaction Exposes Secrets via API
CVE-2026-69252High· 8.8Flowise is a drag & drop user interface to build a customized large language model flow
GHSA-8gj2-2cvc-6xx7MediumFlowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials
CVE-2026-70476High· 8.2Flowise is a drag & drop user interface to build a customized large language model flow