Vulnerability Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1/executions/:id endpoint in packages/server/src/routes/executions/index.ts lacks the checkAnyPermission() middleware that protects other execution endpoints. Any authenticated user, regardless of assigned permissions, can modify execution state, data, and metadata of any execution in their workspace, enabling privilege escalation and manipulation of workflow execution results. This issue is fixed in 3.1.3.
Related Weaknesses (CWE)
References
- https://github.com/FlowiseAI/Flowise/commit/96a9b23b5a103b362a0ee1368d04636755be
- https://github.com/FlowiseAI/Flowise/pull/6409
- https://github.com/FlowiseAI/Flowise/releases/tag/[email protected]
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-fm2f-4339-4p2f
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-fm2f-4339-4p2f
FAQ
What is CVE-2026-70475?
CVE-2026-70475 is a documented vulnerability. Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1/executions/:id endpoint in packages/server/src/routes/executions/index.ts lacks...
How severe is CVE-2026-70475?
CVSS scoring is not yet available for CVE-2026-70475. Check NVD for updates.
Is there a patch for CVE-2026-70475?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.