{"data":{"id":"347f2f8a-8463-4f4e-b515-c05b822bd649","title":"GHSA-fm2f-4339-4p2f: Flowise: Missing Authorization on Execution Update Endpoint","summary":"The PUT /api/v1/executions/:id endpoint in Flowise, as reported in flowise-components@3.1.0, lacks the checkAnyPermission() middleware that protects the GET and DELETE execution endpoints. Any authenticated user, regardless of assigned permissions, can modify any execution record in their workspace, including its state, data and metadata. The issue is classified as CWE-862 (Missing Authorization) with a severity of HIGH (CVSS ~7.5).","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-fm2f-4339-4p2f","publishedAt":"2026-08-04T19:18:47.000Z","cveId":"CVE-2026-70475","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":[],"issueType":"vulnerability","affectedPackages":["flowise@<= 3.1.2 (fixed: 3.1.3)"],"affectedPackageNames":["flowise"],"affectedPackageRefs":["npm:flowise"],"affectedVendors":[],"affectedVendorsRaw":["Flowise"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00458,"epssCheckedAt":"2026-11-04T06:10:13.820Z","kevDateAdded":null,"advisoryAliases":["GHSA-fm2f-4339-4p2f"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-08-04T19:18:47.000Z","fixReleasedAt":"2026-06-25T10:41:14.612Z","daysToFix":-40,"fixCheckedAt":"2026-10-29T21:32:10.887Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["integrity","confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"flowise","fixedVersion":"3.1.3","matchedVersion":"3.1.3","fixReleasedAt":"2026-06-25T10:41:14.612Z","daysToFix":-40,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:32:10.740Z"}]}}