CVE-2026-67621

Katalog CVE

CVSS 7.6 · High EPSS 0,42%

Kerentanan Missing Authorization pada flowiseai flowise. Skor CVSS 3.1 7.6 (High) menurut vulncheck.com.

Deskripsi (NVD)

Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers holding only view-level permissions can send direct HTTP requests to the upsert and refresh document store routes to trigger document ingestion, refresh vector database contents, consume embedding API credits, and modify knowledge bases used by downstream chatflows.

Rincian

Terbit di NVD

6 Agustus 2026

Terakhir diubah

15 September 2026

Status NVD

Analyzed

CVSS 3.1

7.6 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Caycon/cve-advisories/blob/main/2026/Flowise/CVE-2026-67621.md exploit · advisory pihak ketiga
• https://www.vulncheck.com/advisories/flowise-missing-authorization-on-document-store-mutation-endpoints advisory pihak ketiga
• https://flowiseai.com/sunset not applicable