Description

Flowise through 3.1.4 contains missing route-level RBAC checks on chat message endpoints that allow low-privileged API keys to read and delete chat history. Attackers with valid but low-privileged API keys can access GET and DELETE chat message routes without required flow permissions to read chat histories, prompts, model responses, and delete messages.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-26T14:16:40.620Z",
  "pubdate": "2026-09-26T14:16:40.620Z",
  "executiveSummary": "Flowise versions through 3.1.4 contain a critical broken access control vulnerability originating from missing route-level Role-Based Access Control (RBAC) checks on chat message API endpoints.\nThe vulnerability allows users possessing valid, low-privileged API keys to perform unauthorized read and delete operations on chat history, potentially exposing sensitive prompts and model responses.\nThis flaw represents a failure in the application's authorization mechanism, where the backend fails to validate whether an authenticated user has the necessary flow-specific permissions before granting access to sensitive message data.\nThe risk implication is significant, as it grants unauthorized actors access to confidential conversational data and the ability to perform data destruction through illicit deletion requests.\nSuccessful exploitation requires the attacker to possess a valid low-privileged API key, which is then used to craft direct requests to the exposed API routes.\nThere are no requirements for administrative rights, as the vulnerability resides in the application's failure to enforce granular permissions for non-privileged accounts.",
  "technicalDetails": "The root cause of this vulnerability is a design flaw in the authorization logic of the Flowise backend, specifically regarding the handling of chat message endpoints (GET and DELETE).\nIn Flowise versions 3.1.4 and earlier, the application architecture fails to implement mandatory server-side RBAC validation at the route level. When an authenticated request is received for chat message history or deletion, the system verifies the presence of a valid API key but neglects to verify if that key possesses the specific authorization level required for the requested resource (the specific flow or conversation).\nThe exploitation method involves an attacker with an existing, low-privileged API key interacting directly with the chat message API routes. Because the application logic does not perform a permission check against the specific FlowID or message object, the backend processes the request as if the caller is authorized.\nThe attack flow proceeds as follows: First, the attacker identifies the API endpoints responsible for chat message interactions, typically involving HTTP GET requests to retrieve message histories or DELETE requests to purge message logs. Second, the attacker authenticates using their low-privileged key. Third, the attacker issues a request targeting a flow or message identifier to which they should not have access. Fourth, the backend processes the request, bypassing the security policy that should have restricted the scope of the operation based on user-flow ownership or administrative permissions.\nThis behavior exposes the underlying chat infrastructure to unauthorized reconnaissance and data destruction. By exploiting the missing RBAC, an attacker can exfiltrate sensitive data, such as prompts containing intellectual property or confidential model outputs. Furthermore, the ability to execute DELETE commands enables the attacker to compromise data integrity, causing permanent loss of chat logs and histories.\nThe vulnerable component is the API authorization middleware within Flowise, which lacks the necessary hooks to intercept and validate cross-user or unauthorized cross-flow access requests. Given that this is a flaw in the core security implementation, the vulnerability affects all deployments of Flowise 3.1.4 and below, regardless of the underlying network environment or configuration, as the authorization logic occurs entirely within the application layer."
}