Skip to content
OpenAdvisories
High WID-SEC-2026-2703 3 CVEs

Flowise: Mehrere Schwachstellen

Published Aug 6, 2026 · Updated Aug 6, 2026 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen und Daten zu manipulieren.

Product

Flowise ist eine Benutzeroberfläche zur Erstellung von LLMs (Large Language Model).

Vulnerabilities 3

  • Critical 9.9
    CVE-2026-67622

    Flowise 3.1.4 IDOR in OpenAI Assistants Integration

    Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistan…

    FlowiseAI Flowise
  • High 7.6
    CVE-2026-67621

    Flowise 3.1.4 Missing Authorization on Document Store Mutation Endpoints

    Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers holding only view-level permissions can s…

    FlowiseAI Flowise
  • High 7.5
    CVE-2026-70636

    Flowise 3.1.4 Authentication Bypass via OAuth2 Credential Refresh Endpoint

    Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access the OAuth2 credential refresh endpoint by exploiting prefix-based whitelist matching in the authentication middleware defined in packages/ser…

    FlowiseAI Flowise

Revision history

  1. #1

    Initiale Fassung

References