Description

Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers holding only view-level permissions can send direct HTTP requests to the upsert and refresh document store routes to trigger document ingestion, refresh vector database contents, consume embedding API credits, and modify knowledge bases used by downstream chatflows.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-08-06T22:18:22.717Z",
  "pubdate": "2026-08-06T22:18:22.717Z",
  "executiveSummary": "An authorization bypass vulnerability exists within Flowise through version 3.1.4, specifically residing in the document store operations handling. The flaw stems from unprotected mutation endpoints that fail to adequately validate user permissions against requested state-changing actions. Consequently, authenticated workspace members holding restricted, view-level privileges can successfully execute unauthorized administrative and ingestion routines. The impact of this security deficiency encompasses unauthorized document ingestion, forced vector database refreshes, exhaustion of downstream embedding API financial and operational quotas, and malicious tampering with knowledge bases utilized by underlying chatflows. Attackers require baseline authentication as a workspace member with minimal view-level permissions to interact directly with the vulnerable HTTP routes. This vector introduces significant risk regarding data integrity, system resource depletion, and unauthorized knowledge manipulation within multi-tenant or collaborative operational environments.",
  "technicalDetails": "The vulnerability is characterized by a missing function-level access control restriction on sensitive mutation endpoints associated with document store management. Specifically, the affected versions of Flowise fail to enforce role-based access control (RBAC) checks prior to processing requests destined for the upsert and refresh document store routes. The root cause lies in the application logic assuming that interface-level UI restrictions equate to backend API security enforcement. When an authenticated user possessing only view-level permissions initiates a direct HTTP request to these unprotected mutation endpoints, the backend application processes the instructions without validating whether the actor possesses write, edit, or administrative authorization within the target workspace. The exploitation method relies on bypassing the graphical user interface entirely and issuing crafted HTTP requests directly to the backend API routes responsible for document ingestion and vector database synchronization. The attack flow proceeds as follows: First, the low-privileged attacker authenticates to the Flowise instance and obtains a valid session or authorization token corresponding to a view-only workspace role. Second, the attacker formulates an HTTP request targeted at the upsert or refresh document store endpoints. Third, the attacker transmits the payload over the network. Fourth, the backend server accepts the request, bypasses privilege validation, and initiates the resource-intensive document processing operations. The vulnerable components involve the server-side routing and controller logic handling document store mutations. The affected versions include Flowise up to and including 3.1.4. The exploitation requirements dictate that the attacker must have network exposure to the Flowise instance and valid credentials granting baseline workspace membership, albeit restricted to read-only or view-level permissions. Post-exploitation impacts and payload behaviors include the unauthorized ingestion of arbitrary data, forced refreshing of vector database contents leading to potential denial of service or data corruption, excessive consumption of external embedding API credits resulting in financial loss, and the silent modification of critical knowledge bases that drive downstream chatflow accuracy and security posture."
}