Advisoriesby IbisFlowise: improper authorization
summary:
In Flowise, DELETE /api/v1/chatflows/:id authorizes requests with checkAnyPermission('chatflows:delete,agentflows:delete'). Possession of either permission is sufficient to reach the delete path. The delete logic does not validate the target resource type, allowing a caller with only agentflows:delete to delete a CHATFLOW, and a caller with only chatflows:delete to delete an AGENTFLOW.
details:
The delete route accepts either chatflows:delete or agentflows:delete. The subsequent logic only resolves the target record by id and workspaceId, then deletes by id without checking whether the target resource type matches the granted permission domain.
As a result, there is no binding between permission scope and flow type:
agentflows:deletecan be used to deleteCHATFLOWchatflows:deletecan be used to deleteAGENTFLOW
This breaks the intended RBAC separation between Chatflows and Agentflows.
impact:
Users authorized to manage only one flow type can delete the other flow type within the same workspace, resulting in unauthorized deletion and configuration loss.
reproduction steps:
1. Log in as a user who can create API keys.
2. Create a normal CHATFLOW and record its id.
3. Create an API key with only agentflows:delete.
4. Use that API key to send:
```bash
curl -i -X DELETE \
-H 'Authorization: Bearer...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| flowise npm | < 3.1.3 | 3.1.3 |
Details and references
# summary: In Flowise, `DELETE /api/v1/chatflows/:id` authorizes requests with `checkAnyPermission('chatflows:delete,agentflows:delete')`. Possession of either permission is sufficient to reach the delete path. The delete logic does not validate the target resource `type`, allowing a caller with only `agentflows:delete` to delete a `CHATFLOW`, and a caller with only `chatflows:delete` to delete an `AGENTFLOW`. # details: The delete route accepts either `chatflows:delete` or `agentflows:delete`. The subsequent logic only resolves the target record by `id` and `workspaceId`, then deletes by `id` without checking whether the target resource type matches the granted permission domain. As a result, there is no binding between permission scope and flow type: - `agentflows:delete` can be used to delete `CHATFLOW` - `chatflows:delete` can be used to delete `AGENTFLOW` This breaks the intended RBAC separation between Chatflows and Agentflows. # impact: Users authorized to manage only one flow type can delete the other flow type within the same workspace, resulting in unauthorized deletion and configuration loss. # reproduction steps: 1. Log in as a user who can create API keys. 2. Create a normal `CHATFLOW` and record its `id`. 3. Create an API key with only `agentflows:delete`. 4. Use that API key to send: ```bash curl -i -X DELETE \ -H 'Authorization: Bearer <agentflows_delete_only_key>' \ http://localhost:8080/api/v1/chatflows/<chatflow_id> ``` 5. Observe a `200 OK` response, for example: ```json {"raw":[],"affected":1} ``` 6. Read the same `id` again and observe `404 Not Found`.
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-863
- Also known as
- CVE-2026-69262
More Flowise advisories
All Flowise
Flowise: information disclosureCVE-2026-70478fixed in 3.1.3Flowise: CSV Agent Prompt Injection Remote Code Execution VulnerabilityCVE-2026-70477fixed in 3.1.3Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing ManipulationCVE-2026-70476fixed in 3.1.3Flowise: missing authorizationCVE-2026-73603fixed in 3.1.4Flowise: Missing Authorization on Execution Update EndpointCVE-2026-70475fixed in 3.1.3Flowise: Cross-Workspace OAuth2 Credential Metadata LeakCVE-2026-70474fixed in 3.1.3