Summary
Ein Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um Sicherheitsvorkehrungen zu umgehen und um einen Denial-of-Service-Zustand herbeizuführen.
Product
Flowise ist eine Benutzeroberfläche zur Erstellung von LLMs (Large Language Model).
Vulnerabilities 2
-
Medium 6.3
Flowise before 3.1.4 Denial of Service via text-to-speech/abort
Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow pred…
-
Medium 6.1
Flowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-method
Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name endpoint is mounted without any route-level permission check and invokes component loadMethods with an attacker-contro…
Revision history
-
#2
Referenzen ergänzt
-
#1
Initiale Fassung
References
-
GitHub Security Advisory GHSA-hqvm-7539-v83j vom 2026-08-30
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-hqvm-7539-v83j
-
GitHub Security Advisory GHSA-xhxx-56g3-mx2r vom 2026-08-30
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-xhxx-56g3-mx2r