Flowise: Missing Authorization on Execution Update Endpoint
HighCVE-2026-70475 · Published Aug 4, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| flowise npm | < 3.1.3 | 3.1.3 |
Details and references
# Flowise Security Audit Report **Date**: 2026-03-17 **Researcher**: Dimpal Jadhav (jadhavdimpy@gmail.com) **GitHub**: https://github.com/Dimpyj1604 **Target**: FlowiseAI/Flowise (latest main branch) **Version**: flowise-components@3.1.0 ### FINDING 1: Missing Authorization on Execution Update Endpoint **Severity**: HIGH (CVSS ~7.5) **Type**: CWE-862 (Missing Authorization) **File**: `packages/server/src/routes/executions/index.ts:11` **Description**: The `PUT /api/v1/executions/:id` endpoint lacks the `checkAnyPermission()` middleware that protects all other execution endpoints (GET, DELETE). Any authenticated user , regardless of their assigned permissions , can modify any execution record. **Evidence**: ```typescript // Line 7 - GET has permission check router.get('/', checkAnyPermission('executions:view'), executionController.getAllExecutions) // Line 11 - PUT has NO permission check router.put(['/', '/:id'], executionController.updateExecution) // <-- MISSING checkAnyPermission // Line 14 - DELETE has permission checkadvisory_1_execution_auth_bypass router.delete('/:id', checkAnyPermission('executions:delete'), executionController.deleteExecutions) ``` **Impact**: Privilege escalation. A low-privileged user with any valid API key can modify execution state, data, and metadata of any execution in their workspace. Could be used to manipulate workflow execution results or inject data. **Reproduction**: ```bash curl -X PUT https://TARGET/api/v1/executions/EXECUTION_ID \ -H "Authorization: Bearer LOW_PRIV_API_KEY" \ -H "Content-Type: application/json" \ -d '{"state": "FINISHED", "data": "MANIPULATED"}' ```
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-862
- Also known as
- CVE-2026-70475
More Flowise advisories
All Flowise| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 4 | Flowise: IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint CVE-2026-73488Mediumfixed in 3.1.3 | Medium | 3.1.3 |
| Aug 4 | Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration CVE-2026-69250Highfixed in 3.1.3 | High | 3.1.3 |
| Aug 4 | Flowise RCE via TypeORM DataSource CVE-2026-69251Criticalfixed in 3.1.3 | Critical | 3.1.3 |
| Aug 4 | Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization CVE-2026-69252Highfixed in 3.1.3 | High | 3.1.3 |
| Aug 4 | Flowise Sandbox Escape to RCE CVE-2026-69253Criticalfixed in 3.1.3 | Critical | 3.1.3 |
| Aug 4 | Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override CVE-2026-69254Criticalfixed in 3.1.3 | Critical | 3.1.3 |