CVE-2026-71962

Received Received - Intake

Missing Authorization in Flowise Allows Unauthenticated File Access

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: VulnCheck

Description

Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint that allows unauthenticated attackers to access private files by exploiting the endpoint's inclusion in the global authentication whitelist, which bypasses all session and API key verification. Attackers can supply valid chatflowId, chatId, and fileName identifiers to retrieve files from any chatflow on the instance, including private chatflows belonging to other workspaces or organizations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-71962

EUVD

EUVD-2026-55702

Affected Vendors & Products

Vendor	Product	Version / Range
flowise	flowise	From 2.2.4 (inc) to 3.1.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects Flowise versions 2.2.4 through 3.1.4. It is a missing authorization issue in the POST /api/v1/openai-assistants-file/download endpoint. The endpoint is incorrectly included in a global authentication whitelist, allowing unauthenticated attackers to bypass session and API key verification. Attackers can access private files by providing valid identifiers like chatflowId, chatId, and fileName.

Detection Guidance

To detect this vulnerability, check if your Flowise instance is running versions 2.2.4 through 3.1.4. Verify if the POST /api/v1/openai-assistants-file/download endpoint is accessible without authentication. Test by attempting to access private files using valid chatflowId, chatId, and fileName parameters.

Impact Analysis

Unauthenticated attackers can retrieve files from any chatflow on the affected instance, including private files from other workspaces or organizations. This could lead to unauthorized access to sensitive data, intellectual property, or confidential information stored in those files.

Compliance Impact

This vulnerability could result in unauthorized access to personal or sensitive data, violating compliance requirements such as GDPR (data protection) and HIPAA (health information privacy). Organizations using affected Flowise versions may face legal penalties, reputational damage, and loss of trust due to data breaches.

Mitigation Strategies

Immediately upgrade Flowise to a version beyond 3.1.4 where the vulnerability is patched. If upgrading is not possible, restrict access to the /api/v1/openai-assistants-file/download endpoint by removing it from the global authentication whitelist. Review logs for unauthorized file access attempts.

Hi! I’m here to help you understand CVE-2026-71962. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70