{"data":{"id":"695345db-94e4-4294-b32b-dfac83838814","title":"GHSA-8r8h-6vcc-xhrv: Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure","summary":"Flowise has a privilege bypass vulnerability where users without permission to view workspace variables can still access them through the /api/v1/node-custom-function endpoint, which automatically injects $vars (a map containing all workspace variable names and values, including secrets from environment variables) into custom JavaScript code without checking permissions.","solution":"The source recommends: 'Do not inject $vars unless the caller is authorized: enforce variables:view before injecting $vars, or inject only an explicit allowlist of variables needed for the function.' It also suggests considering disabling or restricting runtime type variables (which map to process.env values) in self-hosted environments.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-8r8h-6vcc-xhrv","publishedAt":"2026-08-04T17:43:36.000Z","cveId":"CVE-2026-70471","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["rag_poisoning"],"issueType":"vulnerability","affectedPackages":["flowise@<= 3.1.2 (fixed: 3.1.3)"],"affectedVendors":["LangChain"],"affectedVendorsRaw":["Flowise"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0,"patchAvailable":true,"disclosureDate":"2026-08-04T17:43:36.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"rag","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0020","AML.T0051.001"]}}