CVE-2026-70475
Received Received - Intake

Unauthorized Execution State Modification in Flowise

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: GitHub, Inc.

Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1/executions/:id endpoint in packages/server/src/routes/executions/index.ts lacks the checkAnyPermission() middleware that protects other execution endpoints. Any authenticated user, regardless of assigned permissions, can modify execution state, data, and metadata of any execution in their workspace, enabling privilege escalation and manipulation of workflow execution results. This issue is fixed in 3.1.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-05
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-70475
EUVD
EUVD-2026-52871

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
flowiseai flowise 3.1.3
flowise flowise 3.1.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Flowise allows any authenticated user to modify execution state, data, and metadata of any execution in their workspace due to missing permission checks on the PUT /api/v1/executions/:id endpoint. This enables privilege escalation and manipulation of workflow execution results.

Detection Guidance

Check Flowise server logs for unauthorized PUT requests to /api/v1/executions/:id endpoints. Look for any modifications to execution state, data, or metadata by users without proper permissions. Verify RBAC configurations to ensure only authorized users have the 'executions:update' permission.

Impact Analysis

An attacker with low privileges could remotely modify execution records without user interaction, potentially altering workflow results or injecting malicious data. This compromises data integrity and could lead to unauthorized changes in system behavior.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized data modifications, potentially breaching integrity controls required by GDPR and HIPAA. Unauthorized changes to execution data may lead to non-compliance with data protection and audit standards.

Mitigation Strategies

Upgrade Flowise to version 3.1.3 or later to apply the missing permission checks. Review and restrict the 'executions:update' permission to only authorized roles. Audit execution logs for any suspicious activity prior to the upgrade.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70475. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart