HighVulnerability
GHSA-fm2f-4339-4p2f: Flowise: Missing Authorization on Execution Update Endpoint
- Identifiers
- CVE-2026-70475GHSA-fm2f-4339-4p2f
- Published
- Record updated
- Affected
- flowise <= 3.1.2
- Fixed in
- 3.1.3
- released June 25, 2026, 40 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.5%
Summary
The PUT /api/v1/executions/:id endpoint in Flowise, as reported in flowise-components@3.1.0, lacks the checkAnyPermission() middleware that protects the GET and DELETE execution endpoints. Any authenticated user, regardless of assigned permissions, can modify any execution record in their workspace, including its state, data and metadata. The issue is classified as CWE-862 (Missing Authorization) with a severity of HIGH (CVSS ~7.5).
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- flowisenpmLLM dependency since 2024-03-12