GHSA-fr6g-7cq8-fg82: Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history
Summary
Flowise has a security flaw in its GET /api/v1/upsert-history endpoint (an API endpoint, or a web address the software exposes for requests) that returns the entire server-wide history of data uploads instead of limiting it to each user's own data. The response exposes sensitive configuration details like database URLs and collection names, which could help attackers target the system more effectively.
Vulnerability Details
EPSS: 0.0%
Yes
August 4, 2026
Classification
Affected Vendors
Affected Packages
Related Issues
CVE-2026-63086: text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compat
CVE-2024-37052: Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling
Original source: https://github.com/advisories/GHSA-fr6g-7cq8-fg82
First tracked: August 4, 2026 at 02:00 PM
Classified by LLM (prompt v3) · confidence: 92%