Vulnerability · Published Sep 26, 2026 · Assigned by VulnCheck

CVE-2026-100610Flowise through 3.1.4 Missing Authorization via upsert-history

High 7.5

In plain English

A high-severity authorization bypass via user-controlled key in Flowise from FlowiseAI. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.3%top 71.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspace or ownership validation. getAllUpsertHistory() returns UpsertHistory rows selected solely by an attacker-supplied chatflowid, and patchDeleteUpsertHistory() deletes rows by an attacker-supplied array of record UUIDs. As a result, any authenticated low-privilege user or valid API key can read or delete document-store upsert history belonging to other users and other workspaces whenever the target chatflowId (which is exposed publicly in /chatbot/<chatflowId> share links) or row ids are known. The retrievable flowData and result fields contain embedding, record-manager and vector-store node configuration, including per-node paramValues. No patched version is available.

Affected products (as reported)

Vendor	Product	Versions
FlowiseAI	Flowise	0 – through 3.1.4

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-jvx3-mjpw-r4gh) vendor-advisory
VulnCheck Advisory: Flowise through 3.1.4 Missing Authorization via upsert-history third-party-advisory