CVE-2026-100605 Details

A vulnerability in Flowise versions through 3.1.4 allows low-privileged API keys to bypass route-level role-based access control (RBAC) on chat message endpoints. This oversight enables these API keys to read and delete chat histories, prompts, model responses, and associated metadata. The issue arises because the affected chat message routes do not properly validate permissions before granting access to the read and delete functionalities.

To address this vulnerability, add route-level permission checks to the affected chat message routes. After applying the necessary checks, the routes should correctly respond with a 403 status for requests lacking the required permissions.