Missing Route-Level RBAC Checks in Flowise by FlowiseAI

CVE-2026-100605

What is CVE-2026-100605?

The Flowise product through version 3.1.4 is impacted by inadequate route-level role-based access control (RBAC) checks. This vulnerability allows attackers with low-privileged API keys to bypass security protocols, gaining unauthorized access to sensitive chat message endpoints. Specifically, these API keys can utilize GET and DELETE methods to read user chat histories, model responses, and even delete messages without the necessary permissions, posing a significant risk to data integrity and confidentiality.

References