HIGH

CVE-2026-67621

Flowiseai Flowise 2026-08-06 CVSS v3.1

CVSS

7.6

Description

Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers holding only view-level permissions can send direct HTTP requests to the upsert and refresh document store routes to trigger document ingestion, refresh vector database contents, consume embedding API credits, and modify knowledge bases used by downstream chatflows.

Weakness (CWE)

CWE-862 Missing Authorization

EPSS Score

0.34%

Probability of exploitation in next 30 days

27.8th percentile

References

https://flowiseai.com/sunset Not Applicable https://github.com/Caycon/cve-advisories/blob/main/2026/Flowise/CVE-2026-67621.md Exploit, Third Party Advisory https://www.vulncheck.com/advisories/flowise-missing-authorization-on-document-store-mutation-endpoints Third Party Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE