{"data":{"id":"695345db-94e4-4294-b32b-dfac83838814","title":"GHSA-8r8h-6vcc-xhrv: Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure","summary":"Flowise fetches a workspace's variables without enforcing the variables:view permission at the code-execution path in packages/components/src/utils.ts. Any user or API key that can call /api/v1/node-custom-function gets $vars pre-populated with every workspace variable, including runtime values read from process.env, so a caller denied variables:view can still read secrets such as database passwords, JWT secrets and cloud keys.","solution":"Enforce variables:view before injecting $vars, or inject only an explicit allowlist of the variables a function needs. In self-hosted deployments, consider disabling or heavily restricting type=runtime variables, or restrict which environment keys may be mapped.","labels":["security","privacy"],"sourceUrl":"https://github.com/advisories/GHSA-8r8h-6vcc-xhrv","publishedAt":"2026-08-04T17:43:36.000Z","cveId":"CVE-2026-70471","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["data_extraction"],"issueType":"vulnerability","affectedPackages":["flowise@<= 3.1.2 (fixed: 3.1.3)"],"affectedPackageNames":["flowise"],"affectedPackageRefs":["npm:flowise"],"affectedVendors":[],"affectedVendorsRaw":["Flowise"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00412,"epssCheckedAt":"2026-11-04T06:10:15.713Z","kevDateAdded":null,"advisoryAliases":["GHSA-8r8h-6vcc-xhrv"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-08-04T17:43:36.000Z","fixReleasedAt":"2026-06-25T10:41:14.612Z","daysToFix":-40,"fixCheckedAt":"2026-10-29T21:32:16.177Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"flowise","fixedVersion":"3.1.3","matchedVersion":"3.1.3","fixReleasedAt":"2026-06-25T10:41:14.612Z","daysToFix":-40,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:32:16.030Z"}]}}