Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Advisory: FlowiseAI Flowise — flowiseai.com/sunset Clear all filters
TI-2026-50257 CVE-2026-71962 · GHSA-mf39-7j64-g95c

Flowise 2.2.4 - 3.1.4 Missing Authorization via openai-assistants-file/download

Priority HIGH 77

Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint that allows unauthenticated attackers to access private files by exploiting…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00683 Published 2026-08-10 No fix listed CWE-862
TI-2026-47773 CVE-2026-67620 · GHSA-6h53-jfj2-fh9c

Flowise 3.1.4 SSRF via fetch-links Endpoint Incomplete Deny-List

Priority MEDIUM 61

Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULT_DENY_LIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192…

CVSS 4.0MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00463 Published 2026-08-08 No fix listed CWE-918
TI-2026-49346 CVE-2026-70636 · GHSA-rm9r-9424-cccf

Flowise 3.1.4 Authentication Bypass via OAuth2 Credential Refresh Endpoint

Priority HIGH 77

Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access the OAuth2 credential refresh endpoint by exploiting prefix-based whitelist matching in the authentica…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00663 Published 2026-08-06 No fix listed CWE-862
TI-2026-47775 CVE-2026-67622 · GHSA-qvmw-v4w9-7c4j

Flowise 3.1.4 IDOR in OpenAI Assistants Integration

Priority HIGH 72

Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying a…

CVSS 4.0HIGH 8.5 Network Low privileges No interaction EPSS 0.00479 Published 2026-08-06 No fix listed CWE-639
TI-2026-47774 CVE-2026-67621 · GHSA-7q53-9j99-gg5c

Flowise 3.1.4 Missing Authorization on Document Store Mutation Endpoints

Priority HIGH 65

Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints.

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00417 Published 2026-08-06 No fix listed CWE-862