CVE-2026-70475
— UNSCOREDpublic exploit availablePublished 2026-08-04 · Updated 2026-08-04
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1/executions/:id endpoint in packages/server/src/routes/executions/index.ts lacks the checkAnyPermission() middleware that protects other execution endpoints. Any authenticated user, regardless of assigned permissions, can modify execution state, data, and metadata of any execution in their workspace, enabling privilege escalation and manipulation of workflow execution results. This issue is fixed in 3.1.3.
Weaknesses
CWE-862
Public exploit & PoC references
- https://github.com/FlowiseAI/Flowise/commit/96a9b23b5a103b362a0ee1368d04636755be1bed
- https://github.com/FlowiseAI/Flowise/pull/6409
- https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-fm2f-4339-4p2f
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-fm2f-4339-4p2f
All references
- https://github.com/FlowiseAI/Flowise/commit/96a9b23b5a103b362a0ee1368d04636755be1bed
- https://github.com/FlowiseAI/Flowise/pull/6409
- https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-fm2f-4339-4p2f
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-fm2f-4339-4p2f
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2025-14484
- MEDIUMCVE-2025-14486
- MEDIUMCVE-2025-14487
- UNSCOREDCVE-2026-100240
- MEDIUMCVE-2026-100287
- MEDIUMCVE-2026-100289
- MEDIUMCVE-2026-100303PoC
- MEDIUMCVE-2026-100305PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.