Is CVE-2026-67621 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-67621 being exploited in the wild.

How severe is CVE-2026-67621?

High severity, with a CVSS score of 7.6, published 6 August 2026.

Is there a fix for CVE-2026-67621?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-67621 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-67621?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67621: Flowise missing authorization in document store operations

CVE-2026-67621 · Severity: high · CVSS 7.6 · Published 2026-08-06

Flowise is an AI application builder platform that allows users to create chatbots and workflows. A flaw in access controls allows authenticated users with view-only permissions to modify document stores, refresh databases, and consume API credits by directly calling internal endpoints. This could lead to unauthorized changes to knowledge bases, unexpected cost overruns, and disruption of chatbot functionality.

Quick answers

Is CVE-2026-67621 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-67621 being exploited in the wild.
How severe is CVE-2026-67621?: High severity, with a CVSS score of 7.6, published 6 August 2026.
Which products and versions are affected?: Flowise Flowise through 3.1.4.
Is there a fix for CVE-2026-67621?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-67621 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-67621?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Flowise through version 3.1.4 contains a missing authorization vulnerability in its document store mutation endpoints (upsert and refresh routes). The vulnerability allows authenticated workspace members with only view-level permissions to bypass permission checks and send direct HTTP requests to perform unauthorized operations. Attackers can trigger document ingestion, refresh vector database contents, consume embedding API credits, and modify knowledge bases used by downstream chatflows. The flaw is a horizontal privilege escalation requiring existing workspace membership but no additional authentication. Patches are unlikely given the project's announced sunset on August 31, 2026.

Affected products

Flowise Flowise through 3.1.4

Timeline

2026-08-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.