Vulnerability · Published Aug 6, 2026 · Assigned by VulnCheck

CVE-2026-67621Flowise 3.1.4 Missing Authorization on Document Store Mutation Endpoints

High 7.6

In plain English

A high-severity missing authorization in Flowise from FlowiseAI. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)0.4%top 63.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers holding only view-level permissions can send direct HTTP requests to the upsert and refresh document store routes to trigger document ingestion, refresh vector database contents, consume embedding API credits, and modify knowledge bases used by downstream chatflows.

Affected products (as reported)

Vendor	Product	Versions
FlowiseAI	Flowise	0 – through 3.1.4

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

References

Researcher Disclosure technical-description, exploit
Sunset Announcement vendor-advisory
https://www.vulncheck.com/advisories/flowise-missing-authorization-on-document-store-mutation-endpoints third-party-advisory