CVE-2026-69252
Received Received - Intake

Unauthorized File Access and Deletion in Flowise

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: GitHub, Inc.

Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authenticated API key with unrelated permissions could call GET /api/v1/files to list files under the organization storage root and DELETE /api/v1/files?path=... to delete files belonging to other workspaces in the same organization because getAllFiles and deleteFile used activeOrganizationId and a user-controlled path without restricting access by permissions or activeWorkspaceId. This issue is fixed in version 3.1.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-69252
EUVD
EUVD-2026-52726

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
flowise flowise 3.1.3
flowiseai flowise to 3.1.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Flowise versions before 3.1.3 allows low-privileged authenticated API keys to list and delete files across different workspaces within the same organization. The /api/v1/files endpoint lacked proper authorization checks, enabling unauthorized access by manipulating path parameters.

Detection Guidance

Check Flowise server logs for unauthorized access attempts to /api/v1/files endpoints. Verify API key permissions and ensure no low-privileged keys have access to file operations. Inspect network traffic for GET or DELETE requests to /api/v1/files paths.

Impact Analysis

An attacker with a low-privilege API key could access sensitive files from other workspaces, leading to data leaks or unauthorized deletions. This compromises confidentiality and availability of organizational data stored in Flowise.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by enabling unauthorized access to sensitive files, potentially leading to data breaches and non-compliance with privacy requirements.

Mitigation Strategies

Upgrade Flowise to version 3.1.3 or later. Disable the /api/v1/files endpoint by removing its route registration in server and UI components. Review and restrict API key permissions to prevent unauthorized file access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-69252. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart