{"id":"CVE-2026-70475","aliases":["EUVD-2026-52871","GHSA-fm2f-4339-4p2f"],"status":"published","title":"Flowise: Missing Authorization on Execution Update Endpoint","description":"Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1/executions/:id endpoint in packages/server/src/routes/executions/index.ts lacks the checkAnyPermission() middleware that protects other execution endpoints. Any authenticated user, regardless of assigned permissions, can modify execution state, data, and metadata of any execution in their workspace, enabling privilege escalation and manipulation of workflow execution results. This issue is fixed in 3.1.3.","severity":{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00458,"percentile":0.40014,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2026-08-04T19:18:44Z","modified":"2026-10-28T02:30:47Z","fixes":[{"ecosystem":"npm","package":"flowise","fixed_in":["3.1.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"flowise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.1.2"},{"fixed":"3.1.3"}]}]},{"source":"osv","ecosystem":"npm","package":"flowise","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.1.3"}]}]}],"products":[{"vendor":"flowiseai","product":"flowise"}],"references":[{"url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-fm2f-4339-4p2f","tags":["x_refsource_CONFIRM","exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/FlowiseAI/Flowise/pull/6409","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web"]},{"url":"https://github.com/FlowiseAI/Flowise/commit/96a9b23b5a103b362a0ee1368d04636755be1bed","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://github.com/advisories/GHSA-fm2f-4339-4p2f"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70475.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70475","tags":["advisory"]},{"url":"https://github.com/FlowiseAI/Flowise","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-70475","title":"Flowise: Missing Authorization on Execution Update Endpoint","description":"Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1/executions/:id endpoint in packages/server/src/routes/executions/index.ts lacks the checkAnyPermission() middleware that protects other execution endpoints. Any authenticated user, regardless of assigned permissions, can modify execution state, data, and metadata of any execution in their workspace, enabling privilege escalation and manipulation of workflow execution results. This issue is fixed in 3.1.3.","status":"published","published":"2026-08-04T19:18:44.28Z","modified":"2026-08-04T19:37:54.504Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T13:35:22.169514Z"}],"euvd":[{"id":"EUVD-2026-52871","description":"Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1/executions/:id endpoint in packages/server/src/routes/executions/index.ts lacks the checkAnyPermission() middleware that protects other execution endpoints. Any authenticated user, regardless of assigned permissions, can modify execution state, data, and metadata of any execution in their workspace, enabling privilege escalation and manipulation of workflow execution results. This issue is fixed in 3.1.3.","status":"published","published":"2026-08-04T19:18:44Z","modified":"2026-08-04T19:37:54Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:02:22.516769Z"}],"ghsa":[{"id":"GHSA-fm2f-4339-4p2f","title":"Flowise: Missing Authorization on Execution Update Endpoint","description":"# Flowise Security Audit Report\n**Date**: 2026-03-17\n**Researcher**: Dimpal Jadhav (jadhavdimpy@gmail.com)\n**GitHub**: https://github.com/Dimpyj1604\n**Target**: FlowiseAI/Flowise (latest main branch)\n**Version**: flowise-components@3.1.0\n\n### FINDING 1: Missing Authorization on Execution Update Endpoint\n**Severity**: HIGH (CVSS ~7.5)\n**Type**: CWE-862 (Missing Authorization)\n**File**: `packages/server/src/routes/executions/index.ts:11`\n\n**Description**: The `PUT /api/v1/executions/:id` endpoint lacks the `checkAnyPermission()` middleware that protects all other execution endpoints (GET, DELETE). Any authenticated user — regardless of their assigned permissions — can modify any execution record.\n\n**Evidence**:\n```typescript\n// Line 7 - GET has permission check\nrouter.get('/', checkAnyPermission('executions:view'), executionController.getAllExecutions)\n\n// Line 11 - PUT has NO permission check\nrouter.put(['/', '/:id'], executionController.updateExecution)  // \u003c-- MISSING checkAnyPermission\n\n// Line 14 - DELETE has permission checkadvisory_1_execution_auth_bypass\nrouter.delete('/:id', checkAnyPermission('executions:delete'), executionController.deleteExecutions)\n```\n\n**Impact**: Privilege escalation. A low-privileged user with any valid API key can modify execution state, data, and metadata of any execution in their workspace. Could be used to manipulate workflow execution results or inject data.\n\n**Reproduction**:\n```bash\ncurl -X PUT https://TARGET/api/v1/executions/EXECUTION_ID \\\n  -H \"Authorization: Bearer LOW_PRIV_API_KEY\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"state\": \"FINISHED\", \"data\": \"MANIPULATED\"}'\n```","status":"published","published":"2026-08-04T19:18:47Z","modified":"2026-08-04T19:18:48Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:40:56.852119Z"}],"nvd":[{"id":"CVE-2026-70475","description":"Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1/executions/:id endpoint in packages/server/src/routes/executions/index.ts lacks the checkAnyPermission() middleware that protects other execution endpoints. Any authenticated user, regardless of assigned permissions, can modify execution state, data, and metadata of any execution in their workspace, enabling privilege escalation and manipulation of workflow execution results. This issue is fixed in 3.1.3.","status":"published","published":"2026-08-04T20:16:54.17Z","modified":"2026-10-24T15:10:00.19Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:34.643497Z"}],"osv":[{"id":"CVE-2026-70475","title":"Flowise: Missing Authorization on Execution Update Endpoint","description":"Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1/executions/:id endpoint in packages/server/src/routes/executions/index.ts lacks the checkAnyPermission() middleware that protects other execution endpoints. Any authenticated user, regardless of assigned permissions, can modify execution state, data, and metadata of any execution in their workspace, enabling privilege escalation and manipulation of workflow execution results. This issue is fixed in 3.1.3.","status":"published","published":"2026-08-04T19:18:44.28Z","modified":"2026-10-28T02:30:47.379458503Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:45:15.164658Z"},{"id":"GHSA-fm2f-4339-4p2f","title":"Flowise: Missing Authorization on Execution Update Endpoint","description":"# Flowise Security Audit Report\n**Date**: 2026-03-17\n**Researcher**: Dimpal Jadhav (jadhavdimpy@gmail.com)\n**GitHub**: https://github.com/Dimpyj1604\n**Target**: FlowiseAI/Flowise (latest main branch)\n**Version**: flowise-components@3.1.0\n\n### FINDING 1: Missing Authorization on Execution Update Endpoint\n**Severity**: HIGH (CVSS ~7.5)\n**Type**: CWE-862 (Missing Authorization)\n**File**: `packages/server/src/routes/executions/index.ts:11`\n\n**Description**: The `PUT /api/v1/executions/:id` endpoint lacks the `checkAnyPermission()` middleware that protects all other execution endpoints (GET, DELETE). Any authenticated user — regardless of their assigned permissions — can modify any execution record.\n\n**Evidence**:\n```typescript\n// Line 7 - GET has permission check\nrouter.get('/', checkAnyPermission('executions:view'), executionController.getAllExecutions)\n\n// Line 11 - PUT has NO permission check\nrouter.put(['/', '/:id'], executionController.updateExecution)  // \u003c-- MISSING checkAnyPermission\n\n// Line 14 - DELETE has permission checkadvisory_1_execution_auth_bypass\nrouter.delete('/:id', checkAnyPermission('executions:delete'), executionController.deleteExecutions)\n```\n\n**Impact**: Privilege escalation. A low-privileged user with any valid API key can modify execution state, data, and metadata of any execution in their workspace. Could be used to manipulate workflow execution results or inject data.\n\n**Reproduction**:\n```bash\ncurl -X PUT https://TARGET/api/v1/executions/EXECUTION_ID \\\n  -H \"Authorization: Bearer LOW_PRIV_API_KEY\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"state\": \"FINISHED\", \"data\": \"MANIPULATED\"}'\n```","status":"published","published":"2026-08-04T19:18:47Z","modified":"2026-08-04T19:41:02.36Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:46:46.760785Z"}]}}