CVE-2026-67621

Received Received - Intake

Authenticated Workspace Members Exploit Document Store in Flowise

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: VulnCheck

Description

Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers holding only view-level permissions can send direct HTTP requests to the upsert and refresh document store routes to trigger document ingestion, refresh vector database contents, consume embedding API credits, and modify knowledge bases used by downstream chatflows.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-67621

Affected Vendors & Products

Vendor	Product	Version / Range
flowise	flowise	3.1.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in Flowise versions up to 3.1.4 allows authenticated users with workspace access to perform unauthorized document store operations without proper authorization checks. Specifically, attackers with view-only permissions can exploit unprotected mutation endpoints to send HTTP requests that trigger document ingestion, refresh vector databases, consume embedding API credits, and modify knowledge bases used by chatflows.

Detection Guidance

Check for unauthorized access to document store mutation endpoints by monitoring HTTP requests to routes like /api/v1/document-store/upsert or /api/v1/document-store/refresh. Look for unusual activity from users with view-only permissions.

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive data, increased API credit consumption, and potential manipulation of knowledge bases. Attackers could alter or inject documents, disrupt chatflow functionality, or consume resources without permission, affecting system integrity and availability.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized data access or modification, potentially breaching GDPR's data protection principles or HIPAA's integrity and confidentiality rules. Unauthorized document changes may also impact audit trails and data integrity.

Mitigation Strategies

Upgrade Flowise to a patched version beyond 3.1.4. Restrict access to mutation endpoints by implementing proper authorization checks. Review user permissions to ensure only necessary roles can perform document store operations.

Hi! I’m here to help you understand CVE-2026-67621. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70