{"data":{"id":"cc9b1207-e32e-4ed0-831d-e21039c344f2","title":"GHSA-hmg2-jjjx-jcp2: FlowiseAI: Vector Store No Permission Checks","summary":"FlowiseAI's OpenAI Assistants vector store routes at packages/server/src/routes/openai-assistants-vector-store/index.ts have no checkAnyPermission() middleware on any CRUD operation. Any authenticated user, regardless of role, can create, update, or delete vector stores, upload files to them, and delete files. The source rates the issue HIGH (CVSS ~8.1) under CWE-306 and says the impact includes uploading malicious files and exfiltrating stored documents.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-hmg2-jjjx-jcp2","publishedAt":"2026-05-14T16:19:23.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":[],"issueType":"vulnerability","affectedPackages":["flowise@<= 3.1.1 (fixed: 3.1.2)"],"affectedPackageNames":["flowise"],"affectedPackageRefs":["npm:flowise"],"affectedVendors":["OpenAI"],"affectedVendorsRaw":["FlowiseAI","OpenAI Assistants Vector Store"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-hmg2-jjjx-jcp2"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-05-14T16:19:23.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"rag","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null}}