Skip to content
OpenAdvisories
High WID-SEC-2026-0626 7 CVEs

Flowise: Mehrere Schwachstellen

Published Mar 5, 2026 · Updated Jun 21, 2026 · Revision 3 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um sich erweiterte Berechtigungen zu verschaffen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.

Product

Flowise ist eine Benutzeroberfläche zur Erstellung von LLMs (Large Language Model).

Vulnerabilities 7

  • High 8.8
    CVE-2026-30823

    Flowise: IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, there is an IDOR vulnerability, leading to account takeover and enterprise feature bypass via SSO configuration. This issue has been patched in v…

    FlowiseAI Flowise flowise npm
  • High 8.7
    CVE-2026-30820

    Flowise Authorization Bypass via Spoofed x-request-from Header

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, Flowise trusts any HTTP client that sets the header x-request-from: internal, allowing an authenticated tenant session to bypass all /api/v1/** a…

    FlowiseAI Flowise flowise npm
  • High 8.2
    CVE-2026-30821 EPSS 17%

    Flowise: Arbitrary File Upload via MIME Spoofing

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the /api/v1/attachments/:chatflowId/:chatId endpoint is listed in WHITELIST_URLS, allowing unauthenticated access to the file upload API. While t…

    FlowiseAI Flowise flowise npm
  • High 7.7
    CVE-2026-30822 EPSS 15%

    Flowise: Mass Assignment in `/api/v1/leads` Endpoint

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, unauthenticated users can inject arbitrary values into internal database fields when creating leads. This issue has been patched in version 3.0.1…

    FlowiseAI Flowise flowise npm
  • High 7.7
    CVE-2026-30824 Public exploit Scanner template EPSS 37%

    Flowise: Missing Authentication on NVIDIA NIM Endpoints

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router (/api/v1/nvidia-nim/*) is whitelisted in the global authentication middleware, allowing unauthenticated access to privilege…

    FlowiseAI Flowise flowise npm
  • Medium 6.9
    CVE-2026-56267

    Flowise - PII Disclosure via Unauthenticated Forgot Password Endpoint

    Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoint that returns full user objects including PII to unauthenticated attackers. An attacker can enumerate valid email addresses and harvest se…

    Flowise Flowise flowise npm
  • Medium 6.0
    CVE-2026-56276

    Flowise - Mass Assignment in PUT /api/v1/user Allows Password Hash Override

    Flowise before 3.1.2 contains a mass assignment vulnerability in the PUT /api/v1/user endpoint that allows authenticated users to directly modify the credential field without validation. Attackers can bypass password change verification and session invalidati…

    Flowise Flowise flowise npm

Revision history

  1. #3

    CVE's ergänzt

  2. #2

    Referenz(en) aufgenommen: EUVD-2026-10111, EUVD-2026-10110, EUVD-2026-10109, EUVD-2026-10108, EUVD-2026-10107

  3. #1

    Initiale Fassung

References