HIGH
CVE-2026-70473
CVSS
8.5
Description
Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or workspace. The response can exceed 100MB and includes sensitive configuration data, including Vector Store settings such as Qdrant Server URL and collection name. The observed behavior indicates missing or insufficient authorization checks, workspace/project/tenant isolation, and pagination or limits, exposing integration parameters and infrastructure details that may enable further targeted attacks. This issue is fixed in version 3.1.3.
Weakness (CWE)
CWE-200
Information Exposure
CWE-202
CWE-862
Missing Authorization
EPSS Score
0.3%
Probability of exploitation in next 30 days
22.4th percentile
References
https://github.com/FlowiseAI/Flowise/commit/d81483b70c997ddf981acc9c49fbd9a02fa345cd
Patch
https://github.com/FlowiseAI/Flowise/pull/6170
Issue Tracking, Patch
https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3
Release Notes
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-fr6g-7cq8-fg82
Exploit, Vendor Advisory
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.