Executive brief
Flowise, a platform for building conversational AI applications, fails to enforce proper access controls on chat message endpoints. Attackers with valid but low-privileged API keys can read chat histories, prompts, and model responses they should not access, or delete messages without authorization. This allows data exposure and unauthorized message deletion in multi-tenant environments.
Technical details
The vulnerability exists in missing route-level RBAC checks on GET and DELETE endpoints for chat messages (/api/v1/chatmessage/:id, /api/v1/internal-chatmessage/:id). While the global /api/v1 middleware validates API keys and assigns permissions, the affected chat message controllers bypass the required checkAnyPermission() calls, allowing low-privileged keys to access protected resources. The fix adds explicit permission validation (chatflows:view/agentflows:view for reads, chatflows:delete/agentflows:delete for deletes) at the route level.
Affected products
- FlowiseAI Flowise through 3.1.4
Timeline
- 2026-09-10: disclosed
- 2026-09-26: advisory