Skip to content
OpenAdvisories
High WID-SEC-2026-3313 6 CVEs

Flowise: Mehrere Schwachstellen

Published Sep 10, 2026 · Updated Sep 27, 2026 · Revision 2 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um seine Privilegien zu erhöhen, Benutzerkonten zu übernehmen, Sicherheitsmaßnahmen zu umgehen und Daten zu manipulieren oder offenzulegen.

Product

Flowise ist eine Benutzeroberfläche zur Erstellung von LLMs (Large Language Model).

Vulnerabilities 6

  • High 8.3
    CVE-2026-100608

    Flowise through 3.1.4 Authorization Bypass via BullMQ Dashboard

    Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. When the server runs in queue mode with the dashboard enabled and not in cloud mode (MODE=queue, ENABLE_BULLMQ_DASHBOARD=true, and !isCloud()), the /admin/queues mount is prot…

    FlowiseAI Flowise
  • High 7.7
    CVE-2026-100606

    Flowise through 3.1.4 Authentication Bypass via SSO Email Match

    Flowise through 3.1.4 (Enterprise/platform mode with SSO enabled) contains an authentication bypass in the SSO login path. When an SSO callback arrives with an email matching a user whose status is INVITED, verifyAndLogin (SSOBase.ts:80-94) copies the user re…

    FlowiseAI Flowise
  • High 7.7
    CVE-2026-100607

    Flowise through 3.1.4 Authentication Bypass via Email-Only SSO

    Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing attackers to authenticate as any existing user by claiming their email at any configured SSO provider. Attackers can …

    FlowiseAI Flowise
  • High 7.5
    CVE-2026-100610

    Flowise through 3.1.4 Missing Authorization via upsert-history

    Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspace or ownership validation. getAllUpsertHistory() returns UpsertHistory rows select…

    FlowiseAI Flowise
  • High 7.1
    CVE-2026-100605

    Flowise through 3.1.4 Missing Authorization via Chat Message Routes

    Flowise through 3.1.4 contains missing route-level RBAC checks on chat message endpoints that allow low-privileged API keys to read and delete chat history. Attackers with valid but low-privileged API keys can access GET and DELETE chat message routes without…

    FlowiseAI Flowise
  • Medium 6.8
    CVE-2026-100609

    Flowise through 3.1.4 Insecure Direct Object Reference via Credential

    Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace (findOneBy({ id: credentialId }) with no workspaceId condition) in several code paths: getAllOpenaiAssistan…

    FlowiseAI Flowise

Revision history

  1. #2

    Referenz(en) aufgenommen: CVE-2026-100607, EUVD-2026-87702, CVE-2026-100605, EUVD-2026-87700, CVE-2026-100610, EUVD-2026-87705, CVE-2026-100606, EUVD-2026-87701, CVE-2026-100609, EUVD-2026-87704, CVE-2026-100608, EUVD-2026-87703

  2. #1

    Initiale Fassung

References