CVE-2026-69262
Received Received - Intake

Unauthorized Resource Deletion in Flowise Prior to 3.1.3

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: GitHub, Inc.

Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, `DELETE /api/v1/chatflows/:id` authorized requests with checkAnyPermission('chatflows:delete,agentflows:delete'), so possession of either permission was sufficient to reach the delete path. The delete logic then resolved the target record only by id and workspaceId and did not validate the target resource type, allowing a caller with only agentflows:delete to delete a CHATFLOW and a caller with only chatflows:delete to delete an AGENTFLOW in the same workspace. This issue is fixed in version 3.1.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-69262
EUVD
EUVD-2026-52794

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
flowise flowise 3.1.3
flowiseai flowise to 3.1.3 (exc)
flowiseai flowise 3.1.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Flowise versions 3.1.2 and earlier allows unauthorized deletion of chatflows or agentflows due to improper permission validation. The DELETE endpoint for chatflows checks for either chatflows:delete or agentflows:delete permissions but does not verify the resource type matches the granted permission. This lets users with only agentflows:delete delete chatflows and vice versa within the same workspace.

Detection Guidance

To detect this vulnerability, check Flowise versions prior to 3.1.3. Inspect API logs for DELETE requests to /api/v1/chatflows/:id with mismatched permissions. Look for cases where users with only agentflows:delete delete chatflows or vice versa.

Impact Analysis

This vulnerability can lead to unauthorized users deleting chatflows or agentflows they should not have access to, causing configuration loss and disrupting workflows. Since the issue affects role-based access control separation, it undermines intended permission boundaries, potentially allowing data loss or service disruption within a workspace.

Compliance Impact

This vulnerability could lead to unauthorized deletion of chatflows or agentflows, potentially causing data loss or configuration changes. For GDPR, this may violate integrity and availability principles (Article 5) if personal data is affected. For HIPAA, unauthorized modifications or deletions could compromise data integrity and security requirements under the Security Rule.

Mitigation Strategies

Upgrade Flowise to version 3.1.3 or later. Review and restrict permissions for users with chatflows:delete or agentflows:delete to ensure they only access intended resources. Monitor API activity for unauthorized deletion attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-69262. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart