Flowise 3.1.4 Missing Authorization on Document Store Mutation Endpoints
41Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 7.2epss 0.3%
probabilidad de explotación
0.3%top 80% de las CVE
explotación observada
noninguna fuente lo reporta
1 exploit(s) público(s)
Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers holding only view-level permissions can send direct HTTP requests to the upsert and refresh document store routes to trigger document ingestion, refresh vector database contents, consume embedding API credits, and modify knowledge bases used by downstream chatflows.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Productos afectados
FlowiseAI · FlowisePoCs públicas encontradas — 1
cve_referencegithub.com/Caycon/cve-advisories/blob/main/2026/Flowise/CVE-2026-67621.mdno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.