CVE-2026-50173
Received Received - Intake

Azure Blob Storage SAS Token Exposure in Flow-Like

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, `GET /api/v1/apps/{app_id}/invoke/presign` grants Azure Blob Storage SAS credentials with write and delete access to app content to any app member that has `ExecuteEvents`, even when that member lacks `ReadFiles` and `WriteFiles`. The route treats file permissions as optional after the `ExecuteEvents` gate. When the caller has neither file permission, it selects `CredentialsAccess::InvokeNone`. In the Azure credential provider, `InvokeNone` still mints a `content_sas_token` for `apps/{app_id}` with `sp=rwdl`, plus user-content and log SAS tokens. The returned shared credential is enough for the low-privilege caller to directly write or delete blobs under the app content prefix. Version 1.0.4 patches the issue. Flow-Like Studio and the hosted Flow-Like Web App are not affected. These deployments use AWS-backed storage. Self-hosted deployments are only affected if they use Azure Blob Storage as the storage backend. In affected deployments, the issue only applies to authenticated app members who have workflow execution permissions but should not have app file write/delete permissions. Users of affected self-hosted Azure deployments should update to version 1.0.4 or the latest dev branch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-50173
EUVD
EUVD-2026-62589

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
flow-like flow-like to 1.0.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-50173 is a vulnerability in Flow-Like, a platform for building workflows. It allows authenticated users with ExecuteEvents permission but lacking ReadFiles or WriteFiles permissions to gain write and delete access to app content via Azure Blob Storage SAS tokens. The issue occurs in self-hosted Azure deployments where the endpoint /api/v1/apps/{app_id}/invoke/presign incorrectly grants excessive permissions.

Detection Guidance

Check for unauthorized modifications to Azure Blob Storage containers under app content prefixes. Review logs for excessive SAS token generation requests to the /api/v1/apps/{app_id}/invoke/presign endpoint. Verify user permissions to ensure only authorized users have ExecuteEvents without ReadFiles or WriteFiles.

Impact Analysis

An attacker with ExecuteEvents permission but no file access could modify or delete workflow inputs, outputs, or uploaded content in Azure Blob Storage. This could corrupt data, disrupt workflows, or lead to unauthorized changes in self-hosted Azure deployments.

Compliance Impact

This vulnerability could lead to unauthorized data modification or deletion, violating integrity and confidentiality requirements in GDPR and HIPAA. Affected organizations may face compliance violations if sensitive data is altered or exposed due to this flaw.

Mitigation Strategies

Update Flow-Like to version 1.0.4 or later. If using Azure Blob Storage, restrict access to the /api/v1/apps/{app_id}/invoke/presign endpoint. Audit user permissions to remove ExecuteEvents from users lacking ReadFiles or WriteFiles. Monitor for unauthorized blob modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50173. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart