Flowise vulnerabilities

Flowise before 3.1.3 has an unauthenticated OAuth2 token refresh endpoint that performs server-side HTTP requests to attacker-controlled URLs without SSRF protections, exposing responses and credentials.

Flowise before version 3.1.0 contains a path traversal vulnerability in the Faiss and SimpleStore vector store implementations. Authenticated users can supply an unsanitized basePath parameter, allowing vector store data to be written to arbitrary filesystem locations.

A vulnerability in Flowise before version 3.1.2 sets the Access-Control-Allow-Origin header to a hardcoded wildcard (*) on the text-to-speech (TTS) generation endpoint. This bypasses the server's configured CORS policy and allows any webpage to make cross-origin requests using stored credentials.

A vulnerability in Flowise before version 3.1.3 allows bypassing the denylist of environment variables for Custom MCP nodes. On Windows, where environment variable names are case-insensitive, using 'node_options' instead of 'NODE_OPTIONS' enables injection of --require options and arbitrary code execution.

Flowise before version 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens after a user changes their password. An attacker who already holds an active session, for example via a stolen session token or a device left logged in, remains authenticated as the legitimate user even after the user rotates their credentials.

Flowise before version 3.0.10 has an unverified password change vulnerability. An authenticated user can change their password without providing the current password, allowing an attacker who hijacks a session to take over the account.

Flowise before version 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints. The chatId value is not validated and is passed to streamStorageFile(), where a fallback file-lookup path constructed without the orgId is evaluated after the storage-directory containment check, allowing path traversal beyond the intended storage directory. Unauthenticated attackers can read sensitive files such as /root/.flowise/database.sqlite, exposing all database content in the default configuration.

Flowise before 3.1.0 (versions 3.0.13 and earlier) contains a missing authentication vulnerability in the /api/v1/loginmethod endpoint that allows unauthenticated users to retrieve an organization's complete SSO configuration, including OAuth client secrets in cleartext, by providing an organizationId parameter.

Flowise before 3.1.0 contains a server-side request forgery (SSRF) vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses and access cloud metadata.

Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email change vulnerability. An authenticated user can change the account email address without confirming the change to the original email address or re-entering the current password.

Flowise before 3.1.2 contains an information disclosure vulnerability in the /api/v1/chatflows/apikey/:apikey endpoint. When the keyonly query parameter is omitted, the endpoint returns not only the chatflows bound to the supplied API key but also all chatflows across every workspace that have no API key assigned.

Flowise before 3.1.2 contains a mass assignment vulnerability in the PUT /api/v1/user endpoint that allows authenticated users to directly modify the credential field without validation. Attackers can bypass password change verification and session invalidation by supplying a crafted password hash, establishing persistent account access after temporary session compromise.

Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoint that returns full user objects including PII to unauthenticated attackers. An attacker can enumerate valid email addresses and harvest sensitive user data including user IDs, names, account status, and timestamps by sending requests with known email addresses.

Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient input filtering in chat messages and custom agent functions. An attacker can inject malicious JavaScript, leading to cookie and session data theft.

Flowise prior to version 3.1.2 has a mass-assignment vulnerability in evaluator create and update that allows cross-workspace evaluator takeover.

Flowise prior to version 3.1.2 has a mass-assignment vulnerability in evaluation create and update that allows cross-workspace evaluation takeover.

Flowise prior to version 3.1.2 has a mass-assignment vulnerability in DatasetRow create and update that allows cross-workspace row takeover.

Flowise prior to version 3.1.2 allows cross-workspace dataset takeover via mass-assignment during dataset creation and update. This issue has been patched in version 3.1.2.

Flowise prior to version 3.1.2 allows cross-workspace template takeover via mass-assignment during CustomTemplate creation and update. This issue has been patched in version 3.1.2.

Flowise prior to version 3.1.2 allows cross-workspace assistant takeover via mass-assignment during assistant creation and update. This issue has been patched in version 3.1.2.

Flowise before version 3.1.2 lacks authentication and access control for OpenAI Assistants Vector Store CRUD endpoints. No authorization when using API key.

Flowise prior to version 3.1.2 does not strip the encryptedData field from API responses when fetching credentials with a credentialName filter. Without the filter the field is omitted, but with the filter it is not, leading to leakage of encrypted data.

Flowise prior to version 3.1.2 has a mass assignment vulnerability in the chatflow update endpoint. It allows an authenticated user to modify server-controlled properties such as deployed, isPublic, workspaceId, and reassign the resource to another workspace.

A mass assignment vulnerability in the tool update endpoint of Flowise allows authenticated users to modify server-controlled properties such as workspaceId, breaking tenant isolation in multi-workspace environments.