CVE-2026-70475Medium· 6.5▾ SunlitFlowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1/executions/:id endpoint in packages/server/src/routes/executions/index.ts lacks the checkAnyPermission() middleware …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.3%
6.5 → —
medium → high
— → 6.5
high → medium
6.5 → —
medium → high
— → 6.5
high → medium
6.5 → —
medium → high
— → 6.5
high → medium
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1/executions/:id endpoint in packages/server/src/routes/executions/index.ts lacks the checkAnyPermission() middleware that protects other execution endpoints. Any authenticated user, regardless of assigned permissions, can modify execution state, data, and metadata of any execution in their workspace, enabling privilege escalation and manipulation of workflow execution results. This issue is fixed in 3.1.3.
flowise < 3.1.3Upgrade past the affected range:
flowise 3.1.3Affected packages:
flowise <= 3.1.2Patched in:
flowise 3.1.3Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-70473High· 8.5Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows
CVE-2026-69252High· 8.8Flowise is a drag & drop user interface to build a customized large language model flow
GHSA-8gj2-2cvc-6xx7MediumFlowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials
CVE-2026-70476High· 8.2Flowise is a drag & drop user interface to build a customized large language model flow
CVE-2026-70477Critical· 9.8Flowise is a drag & drop user interface to build a customized large language model flow
CVE-2026-70471Medium· 6.5Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows