CyberRota Analysis
AI-GeneratedPrior to version 3.1.3, Flowise's API allowed users with either the `chatflows:delete` or `agentflows:delete` permissions to delete both chatflows and agentflows, regardless of their actual permissions for the specific resource type. This vulnerability could lead to unauthorized deletion of critical components within the application, impacting data integrity and availability. Organizations utilizing Flowise versions prior to 3.1.3 should prioritize upgrading to mitigate the risk of unauthorized deletions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, `DELETE /api/v1/chatflows/:id` authorized requests with checkAnyPermission('chatflows:delete,agentflows:delete'), so possession of either permission was sufficient to reach the delete path. The delete logic then resolved the target record only by id and workspaceId and did not validate the target resource type, allowing a caller with only agentflows:delete to delete a CHATFLOW and a caller with only chatflows:delete to delete an AGENTFLOW in the same workspace. This issue is fixed in version 3.1.3.