CVE-2026-70475 in Flowise
Summary
by MITRE • 08/04/2026
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1/executions/:id endpoint in packages/server/src/routes/executions/index.ts lacks the checkAnyPermission() middleware that protects other execution endpoints. Any authenticated user, regardless of assigned permissions, can modify execution state, data, and metadata of any execution in their workspace, enabling privilege escalation and manipulation of workflow execution results. This issue is fixed in 3.1.3.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/04/2026
The vulnerability identified in Flowise versions prior to 3.1.3 represents a critical authorization flaw that undermines the security model of the application's execution management system. The PUT /api/v1/executions/:id endpoint in packages/server/src/routes/executions/index.ts serves as a crucial interface for modifying workflow execution states, yet it fails to implement proper permission validation mechanisms that are present in other similar endpoints within the same application. This oversight creates a privilege escalation vector that allows any authenticated user to manipulate execution data regardless of their assigned permissions or role within the system.
The technical flaw stems from the absence of checkAnyPermission() middleware implementation specifically for this endpoint, while other execution-related endpoints properly enforce access controls. This inconsistency in security enforcement creates an attack surface where unauthorized modifications can occur at the execution level, potentially affecting the integrity and confidentiality of workflow processes. The vulnerability exists because the application's permission system relies on middleware validation to ensure that users can only perform actions they are authorized to execute, but this validation is completely bypassed for the specific PUT endpoint targeting execution resources.
From an operational perspective, this vulnerability enables authenticated attackers to manipulate workflow execution results, modify execution data, and alter metadata associated with any execution within their workspace. The impact extends beyond simple data modification as it allows for potential disruption of business processes, manipulation of automated workflows, and possible exploitation of the system's execution state to achieve unauthorized actions. Attackers could leverage this vulnerability to corrupt execution results, interfere with business-critical workflows, or potentially escalate privileges further by modifying execution parameters that control access to other system resources.
The security implications align with CWE-284 (Improper Access Control) and represent a violation of the principle of least privilege that should govern all application interfaces. This flaw also maps to ATT&CK technique T1078 (Valid Accounts) as it allows attackers to leverage their authenticated access to perform unauthorized operations within the system. Organizations using Flowise versions prior to 3.1.3 should immediately implement mitigations including updating to version 3.1.3 or later, implementing additional access controls at the network level, monitoring execution endpoint access patterns, and conducting comprehensive security assessments of all API endpoints to identify similar authorization gaps. The fix in version 3.1.3 addresses this by properly implementing the checkAnyPermission() middleware for the affected endpoint, ensuring that only users with appropriate permissions can modify execution resources.
This vulnerability demonstrates the importance of consistent security implementation across all application interfaces and highlights how seemingly minor oversights in permission validation can create significant security risks. The remediation process should include thorough code review to ensure similar issues do not exist in other endpoints, implementation of automated security testing for access control mechanisms, and establishment of security guidelines that mandate comprehensive permission validation for all API endpoints handling sensitive operations.