CVE-2026-100608 Details

A vulnerability exists in Flowise versions through 3.1.4 that allows authorization bypass on the BullMQ admin dashboard. When the server is in queue mode with the dashboard enabled and not in cloud mode, the '/admin/queues' route is only protected by a middleware that verifies JWTs. This middleware does not check roles, permissions, or workspace/organization scopes. As a result, any authenticated user, including those with the lowest privileges, can access the full Bull-Board UI and view all queues and job payloads across the entire instance. This includes sensitive information such as chat inputs, override configurations (which may contain credentials and prompts), chatflow data with custom function source code, credential IDs, system prompts, chat IDs, files, and organizational identifiers. Furthermore, the dashboard's write actions, such as retrying or removing jobs, can be performed across different tenants.

Add a permission check to the '/admin/queues' mount to restrict access to authorized users only. This can be done by incorporating the 'checkPermission' function from the RBAC permission check module, or by gating access to organization admins only. Until a patch is available, users can disable the BullMQ dashboard or restrict access to it at the network layer.