CVE-2026-70475: Flowise missing authorization in execution update endpoint

Executive brief

Flowise, an open-source tool for building LLM-based workflows, contains a security flaw in how it handles workflow execution updates. An authenticated user with low-level access can bypass intended restrictions to modify the state or data of any execution record within their workspace. This could allow an attacker to manipulate workflow results or inject unauthorized data into the system.

Technical details

A missing authorization vulnerability (CWE-862) exists in Flowise versions up to 3.1.2. The 'PUT /api/v1/executions/:id' endpoint fails to implement the 'checkAnyPermission()' middleware, which is correctly applied to GET and DELETE operations in the same route file. An attacker with a valid low-privileged API key can exploit this to modify the state, data, and metadata of any execution record. This vulnerability was addressed in version 3.1.3 by adding the appropriate permission checks to the update route.

Affected products

• FlowiseAI flowise <= 3.1.2

Timeline

• 2026-03-17: disclosed: Vulnerability discovered by researcher Dimpal Jadhav
• 2026-07-29: patched: Fix released in version 3.1.3
• 2026-08-04: advisory: GitHub Advisory published

References

• https://api.github.com/users/Dimpyj1604
• https://github.com/Dimpyj1604
• https://api.github.com/users/Dimpyj1604/gists%7B/gist_id%7D
• https://api.github.com/users/Dimpyj1604/repos
• https://avatars.githubusercontent.com/u/111214557?v=4
• https://api.github.com/users/Dimpyj1604/events%7B/privacy%7D