CyberRota Analysis
AI-GeneratedFlowise versions prior to 3.1.3 are vulnerable due to inadequate authorization checks in the GET /api/v1/upsert-history endpoint, which exposes the entire server-wide upsert history, including sensitive configuration data. This can lead to significant information disclosure, potentially allowing attackers to exploit integration parameters and infrastructure details for further attacks. Organizations using Flowise, especially those handling sensitive data, should prioritize upgrading to version 3.1.3 to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or workspace. The response can exceed 100MB and includes sensitive configuration data, including Vector Store settings such as Qdrant Server URL and collection name. The observed behavior indicates missing or insufficient authorization checks, workspace/project/tenant isolation, and pagination or limits, exposing integration parameters and infrastructure details that may enable further targeted attacks. This issue is fixed in version 3.1.3.