{"data":{"id":"b04ac500-1e5a-4291-be0f-8724344bf759","title":"GHSA-fr6g-7cq8-fg82: Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history","summary":"The GET /api/v1/upsert-history endpoint in Flowise returns the entire server-wide upsert history, with responses over 100MB, instead of scoping results to the requesting user, tenant or workspace. The response exposes sensitive vector store configuration, including the Qdrant Server URL and collection name. The advisory rates this High severity information disclosure.","solution":"N/A -- no mitigation discussed in source.","labels":["security","privacy"],"sourceUrl":"https://github.com/advisories/GHSA-fr6g-7cq8-fg82","publishedAt":"2026-08-04T17:57:27.000Z","cveId":"CVE-2026-70473","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["flowise@<= 3.1.2 (fixed: 3.1.3)"],"affectedPackageNames":["flowise"],"affectedPackageRefs":["npm:flowise"],"affectedVendors":[],"affectedVendorsRaw":["Flowise","Qdrant"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00451,"epssCheckedAt":"2026-11-04T12:08:35.257Z","kevDateAdded":null,"advisoryAliases":["GHSA-fr6g-7cq8-fg82"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-08-04T17:57:27.000Z","fixReleasedAt":"2026-06-25T10:41:14.612Z","daysToFix":-40,"fixCheckedAt":"2026-10-29T21:32:13.138Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"rag","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"flowise","fixedVersion":"3.1.3","matchedVersion":"3.1.3","fixReleasedAt":"2026-06-25T10:41:14.612Z","daysToFix":-40,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:32:12.991Z"}]}}