Authorization Vulnerability in Flowise by FlowiseAI

CVE-2026-100610

What is CVE-2026-100610?

Flowise versions up to 3.1.4 have a significant vulnerability that affects the API endpoint for managing upsert history. The vulnerability arises from a lack of proper route-level permission checks, allowing any authenticated low-privilege user or those with a valid API key to access, read, and delete upsert history data that belongs to other users across different workspaces. This occurs as the getAllUpsertHistory() function retrieves records based solely on an attacker-controlled chatflow ID, while the patchDeleteUpsertHistory() function allows for the deletion of records identified through an array of UUIDs supplied by the attacker. This exposure can reveal sensitive configuration data such as embedding and record-manager settings, which can be exploited for further attacks. Unfortunately, there is currently no patched version available.

References