Cpe:2.3:a:flowise:flowise:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aflowiseflowise/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 26 Sep 2026 15:00:42 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAuthorization Bypass in Flowise Chat Message Endpointshttps://feed.craftedsignal.io/briefs/2026-09-flowise-rbac-vuln/Sat, 26 Sep 2026 15:00:42 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-flowise-rbac-vuln/Flowise versions up to 3.1.4 are vulnerable to unauthorized access due to missing route-level RBAC checks, allowing low-privileged API keys to read and delete sensitive chat history.Flowise versions through 3.1.4 contain a critical authorization vulnerability originating from missing route-level Role-Based Access Control (RBAC) checks on chat message endpoints. This vulnerability allows attackers in possession of low-privileged API keys to bypass intended permission restrictions. By targeting specific GET and DELETE API routes, an unauthorized actor can access chat histories, internal prompts, and model responses, or perform destructive actions by deleting message logs without holding the necessary flow permissions. This defect significantly impacts the confidentiality and integrity of sensitive chat data managed within the Flowise environment. Organizations deploying Flowise should treat this as a high-priority security concern.

Impact

Successful exploitation allows low-privileged users to bypass access control constraints, leading to the unauthorized exfiltration of sensitive AI prompts and customer chat history. Furthermore, the ability to issue DELETE requests to the message endpoints permits attackers to disrupt or purge chat logs, which may impact audit trails and service availability.

Recommendation

  • Immediately restrict access to the Flowise API to trusted internal networks while awaiting official patches.
  • Audit application logs for abnormal patterns of GET or DELETE requests to chat message endpoints originating from known low-privileged service accounts or API keys.
  • Upgrade to the latest version of Flowise as soon as a security update is released by the maintainer.
]]>highadvisoryauthorization-bypassapi-securityrbacauthentication-bypassidentity-managementssoidordata-exfiltration