Executive brief
Flowise is an AI application builder platform that allows users to create chatbots and workflows. A flaw in access controls allows authenticated users with view-only permissions to modify document stores, refresh databases, and consume API credits by directly calling internal endpoints. This could lead to unauthorized changes to knowledge bases, unexpected cost overruns, and disruption of chatbot functionality.
Technical details
Flowise through version 3.1.4 contains a missing authorization vulnerability in its document store mutation endpoints (upsert and refresh routes). The vulnerability allows authenticated workspace members with only view-level permissions to bypass permission checks and send direct HTTP requests to perform unauthorized operations. Attackers can trigger document ingestion, refresh vector database contents, consume embedding API credits, and modify knowledge bases used by downstream chatflows. The flaw is a horizontal privilege escalation requiring existing workspace membership but no additional authentication. Patches are unlikely given the project's announced sunset on August 31, 2026.
Affected products
- Flowise Flowise through 3.1.4
Timeline
- 2026-08-06: disclosed