Advisories · Technology
Flowise.
Every CVE that names Flowise among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.7 High
Flowise through 3.1.4 Missing Authorization via upsert-history
- Flowise
- Broken access control
- CVSS 7.6 High
Flowise through 3.1.4 Insecure Direct Object Reference via Credential
- Flowise
- Broken access control
- CVSS 8.7 High
Flowise through 3.1.4 Authorization Bypass via BullMQ Dashboard
- Flowise
- Broken access control
- CVSS 9.2 CriticalCritical · CVSS 9+
Flowise through 3.1.4 Authentication Bypass via Email-Only SSO
- Flowise
- Authentication bypass
- CVSS 9.2 CriticalCritical · CVSS 9+
Flowise through 3.1.4 Authentication Bypass via SSO Email Match
- Flowise
- Authentication bypass
- CVSS 7.5 High
Flowise through 3.1.4 Missing Authorization via Chat Message Routes
- Flowise
- Broken access control
- CVSS 7.6 High
Flowise before 3.1.4 Server-Side Request Forgery via document loaders
- Flowise
- Server-side request forgery (SSRF)
- CVSS 8.7 High
Flowise before 3.1.4 NoSQL Injection via sessionId
- Flowise
- Other injection
- CVSS 8.3 High
Flowise before 3.1.4 Script Injection via Docker Workflows
- Flowise
- Command injection
- CVSS 8.7 High
Flowise before 3.1.4 SSRF and API Key Exfiltration via Chat Model Nodes
- Flowise
- Server-side request forgery (SSRF)
- CVSS 8.7 High
Flowise before 3.1.4 Remote Code Execution via SQL Database Chain
- Flowise
- Path traversal
- CVSS 7.6 High
Flowise before 3.1.4 Authorization Bypass via openai-realtime
- Flowise
- Broken access control
- CVSS 9.0 CriticalCritical · CVSS 9+
Flowise before 3.1.4 Remote Code Execution via cwd Parameter
- Flowise
- CWE-20
- CVSS 9.0 CriticalCritical · CVSS 9+
Flowise before 3.1.4 Remote Code Execution via Custom MCP npx
- Flowise
- Command injection
- CVSS 7.7 High
Flowise before 3.1.4 Cross-Tenant Organization Admin Takeover
- Flowise
- Privilege escalation
- CVSS 7.6 High
Flowise before 3.1.4 Cross-Tenant Authorization Bypass
- Flowise
- Broken access control
- CVSS 5.3 Medium
FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery
- Flowise
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
Flowise before 3.1.4 Denial of Service via text-to-speech/abort
- Flowise
- Broken access control
- CVSS 6.1 Medium
Flowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-method
- Flowise
- Broken access control
- CVSS 6.0 Medium
Flowise before 3.1.4 Broken Access Control via organizationuser
- Flowise
- Broken access control
- CVSS 9.0 CriticalCritical · CVSS 9+
Flowise before 3.1.3 Sandbox Escape to RCE
- Flowise
- Code injection
- CVSS 9.0 CriticalCritical · CVSS 9+
Flowise before 3.1.3 Remote Code Execution via Custom MCP
- Flowise
- Code injection
- CVSS 9.0 CriticalCritical · CVSS 9+
Flowise before 3.1.3 Code Injection via CSV Agent customReadCSV
- Flowise
- Code injection
- CVSS 9.0 CriticalCritical · CVSS 9+
Flowise before 3.1.3 Remote Code Execution via Airtable Agent
- Flowise
- Code injection
- CVSS 8.6 High
Flowise before 3.1.3 Sandbox Escape via Pandas Methods
- Flowise
- CWE-184
- CVSS 8.7 High
Flowise 2.2.4 - 3.1.4 Missing Authorization via openai-assistants-file/download
- Flowise
- Broken access control
- CVSS 6.3 Medium
Flowise 3.1.4 SSRF via fetch-links Endpoint Incomplete Deny-List
- Flowise
- Server-side request forgery (SSRF)
- CVSS 8.7 High
Flowise 3.1.4 Authentication Bypass via OAuth2 Credential Refresh Endpoint
- Flowise
- Broken access control
- CVSS 8.5 High
Flowise 3.1.4 IDOR in OpenAI Assistants Integration
- Flowise
- Broken access control
- CVSS 7.2 High
Flowise 3.1.4 Missing Authorization on Document Store Mutation Endpoints
- Flowise
- Broken access control
- CVSS 2.3 Low
Flowise - Custom MCP Environment Variable Denylist Bypass via Case Sensitivity
- Flowise
- CWE-178
- CVSS 5.3 Medium
FlowiseAI Flowise S3 Document Loader S3.ts path traversal
- Flowise
- Path traversal
- CVSS 6.3 Medium
FlowiseAI Flowise Endpoint account.service.ts verify information disclosure
- Flowise
- Information disclosure
- Broken access control
- CVSS 5.3 Medium
FlowiseAI Flowise User Controller authorization
- Flowise
- Broken access control
- CVSS 9.6 CriticalCritical · CVSS 9+
Critical Multi-Tenant Variable Disclosure in Flowise Cloud via Custom JavaScript Function
- Flowise
- Information disclosure
- Broken access control