CVE-2026-100605
Deferred Deferred - Pending Action

Missing Route-Level RBAC Checks in Flowise 3.1.4

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Flowise through 3.1.4 contains missing route-level RBAC checks on chat message endpoints that allow low-privileged API keys to read and delete chat history. Attackers with valid but low-privileged API keys can access GET and DELETE chat message routes without required flow permissions to read chat histories, prompts, model responses, and delete messages.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100605
EUVD
EUVD-2026-87700

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
flowise flowise 3.1.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Flowise versions up to 3.1.4 involves missing authorization checks on chat message endpoints. Attackers with low-privileged API keys can access GET and DELETE routes to read or delete chat histories, including prompts and model responses, without proper permissions.

Detection Guidance

To detect this vulnerability, inspect Flowise API endpoints for unauthorized access to GET and DELETE chat message routes. Check logs for low-privileged API keys accessing these endpoints. Verify if RBAC checks are missing on /api/v1/chat-messages or similar routes. Use tools like curl to test endpoints with low-privilege keys.

Impact Analysis

Attackers could read sensitive chat histories, delete messages, or access internal data like prompts and model responses. This could lead to data leaks, unauthorized modifications, or loss of critical information stored in chat histories.

Compliance Impact

This vulnerability could lead to unauthorized access or deletion of sensitive data, violating GDPR's data protection principles or HIPAA's requirements for safeguarding protected health information. Non-compliance risks fines and legal consequences.

Mitigation Strategies

Immediately update Flowise to the latest patched version. If no patch is available, restrict API key privileges and disable low-privileged keys. Implement route-level RBAC checks manually if possible. Monitor chat message endpoints for unauthorized access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100605. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart