{"data":{"id":"42e970d0-c039-448c-9292-d30fb99d2c1d","title":"GHSA-wp74-f5hh-5f3r: Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization","summary":"Flowise has a missing authorization bug in the `/api/v1/files` endpoint that allows any API key within an organization to list and delete files from other workspaces, even if that API key has no permission to access files. The endpoint only checks if files are enabled as a feature, but does not verify that the API key has permission to access files in that specific workspace, breaking the isolation between workspaces.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-wp74-f5hh-5f3r","publishedAt":"2026-08-04T14:54:03.000Z","cveId":"CVE-2026-69252","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["flowise@<= 3.1.2 (fixed: 3.1.3)"],"affectedVendors":["LangChain"],"affectedVendorsRaw":["Flowise"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0,"patchAvailable":true,"disclosureDate":"2026-08-04T14:54:03.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":["AML.T0010"]}}