CVE-2026-100606
HighCVSS 7.7Summary
Flowise through 3.1.4 contains an authentication bypass in the SSO login path when an SSO callback arrives with an email matching an INVITED user, allowing takeover of the invitation.
Risk Assessment
Anyone with knowledge of the invitee's email can obtain access to the organization without possessing the emailed invitation token, as long as the invitation is valid (24 hours by default).
Recommendation
Apply a patched version if available. Limit invitation validity and monitor SSO login logs.
Other vulnerabilities in Flowise
See all- CVE-2026-100610High
Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspace or ownership validation.
- CVE-2026-100609Medium
Flowise (npm packages flowise and flowise-components) through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace in several code paths, including getAllOpenaiAssistants/getSingleOpenaiAssistant, uploadFilesToAssistant, deleteAssistant, and the shared helper used by getVoices. An authenticated user of one workspace can supply a credential UUID belonging to another workspace, causing the server to decrypt and use that workspace's OpenAI or ElevenLabs API key on the attacker's behalf.
- CVE-2026-100608High
Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. When running in queue mode with the dashboard enabled, any authenticated user can access /admin/queues.
- CVE-2026-100607High
Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing attackers to authenticate as any existing user by claiming their email.
- CVE-2026-100605High
Flowise through 3.1.4 contains missing route-level RBAC checks on chat message endpoints, allowing low-privileged API keys to read and delete chat history.
- CVE-2026-52098Critical
An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/<flowId> endpoint.
- CVE-2026-73602Critical
Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass.
- CVE-2026-73487Critical
Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code via prompt injection.
- CVE-2026-67622Critical
A vulnerability in Flowise (up to 3.1.4) in the OpenAI Assistants integration allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID without workspace ownership verification.
- CVE-2026-70478Critical
Flowise prior to 3.1.3 contains a vulnerability in the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint, which is in WHITELIST_URLS and requires no authentication. An attacker with a credential ID can refresh the OAuth token and gain access to the victim's connected service, as well as exhaust refresh-token quota.
Original NVD description (English source)
Flowise through 3.1.4 (Enterprise/platform mode with SSO enabled) contains an authentication bypass in the SSO login path. When an SSO callback arrives with an email matching a user whose status is INVITED, verifyAndLogin (SSOBase.ts:80-94) copies the user record from the database — including the server-stored single-use invitation tempToken — into the data passed to AccountService.register(). The register handler's token lookup, email match, and expiry checks therefore pass trivially against the server's own token instead of a caller-supplied one, and the account and its organization membership are flipped to ACTIVE. As a result, anyone able to authenticate at any configured SSO provider using a pending invitee's email address as the email claim can take over that invitation and obtain the invited user's access to the organization without ever possessing the emailed invitation token, for as long as the invitation is valid (24 hours by default). At the time of the advisory no patched version was available.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS