Insufficient Authorization in Flowise UI Exposes Sensitive Data

CVE-2026-70473

What is CVE-2026-70473?

Flowise, a drag-and-drop interface for creating customized large language model (LLM) flows, suffers from insufficient authorization checks in its GET /api/v1/upsert-history endpoint. Versions prior to 3.1.3 return extensive server-wide upsert history, revealing sensitive configurations such as Vector Store parameters, potentially exceeding 100MB in response size. This flaw compromises tenant, workspace, and project isolation, allowing unauthorized exposure of critical integration data. Proper pagination and authorization mechanisms must be implemented to secure user-specific data and protect against targeted attacks.

References