Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um Informationen offenzulegen und Sicherheitsmaßnahmen zu umgehen, was weitere Angriffe ermöglicht.
Product
Flowise ist eine Benutzeroberfläche zur Erstellung von LLMs (Large Language Model).
Vulnerabilities 2
-
Medium 6.3
FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery
A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/evaluations/index.ts of the component Evaluations Endpoint. The manipulation of the argument Host/X-Forw…
-
Medium 6.0
Flowise before 3.1.4 Broken Access Control via organizationuser
Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser that allows any authenticated organization member to retrieve the organization owner's full user record including bcrypt password hash and temporary tokens. At…
Revision history
-
#1
Initiale Fassung
References
-
GitHub Security Advisory GHSA-hwr2-69f4-g9h6 vom 2026-09-13
https://github.com/advisories/GHSA-hwr2-69f4-g9h6
-
GitHub Security Advisory GHSA-WFVF-R9GR-6QFQ vom 2026-09-13
https://github.com/advisories/GHSA-WFVF-R9GR-6QFQ