CyberRota Analysis
AI-GeneratedThe Flowise application prior to version 3.1.3 has a vulnerability in the /api/v1/files route, allowing low-privileged authenticated users to list and delete files across different workspaces within the same organization due to insufficient permission checks. This could lead to unauthorized access and data loss, impacting organizations that utilize Flowise for managing large language model workflows. Users of versions prior to 3.1.3 should prioritize upgrading to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authenticated API key with unrelated permissions could call GET /api/v1/files to list files under the organization storage root and DELETE /api/v1/files?path=... to delete files belonging to other workspaces in the same organization because getAllFiles and deleteFile used activeOrganizationId and a user-controlled path without restricting access by permissions or activeWorkspaceId. This issue is fixed in version 3.1.3.