CVE-2026-56268 Details
Description
Flowise before 3.1.2 contains an information disclosure vulnerability in the /api/v1/chatflows/apikey/:apikey endpoint. When the keyonly query parameter is omitted (the default), the endpoint returns not only the chatflows bound to the supplied API key but also all chatflows across every workspace that have no API key assigned, because the underlying query lacks any workspace filter. An attacker with a valid API key for one workspace can therefore retrieve the full ChatFlow configuration (including flowData with system prompts and node configurations, chatbotConfig, apiConfig, and credential IDs) of unprotected chatflows belonging to other workspaces.
A cross-workspace information disclosure vulnerability exists in Flowise versions prior to 3.1.2, specifically within the '/api/v1/chatflows/apikey/:apikey' endpoint. When the 'keyonly' query parameter is not specified, the endpoint reveals not only the chatflows associated with the provided API key but also all chatflows across every workspace that lack an assigned API key. This oversight allows an attacker with a valid API key from one workspace to access the complete configuration of unprotected chatflows from other workspaces, including sensitive data such as system prompts, node configurations, and credential IDs.
Users are advised to update Flowise to version 3.1.2 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-c2c9-mfw7-p8hw | CISA-ADP | ExploitThird Party Advisory |
| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-c2c9-mfw7-p8hw | [email protected] | ExploitThird Party Advisory |
| https://www.vulncheck.com/advisories/flowise-cross-workspace-information-disclosure-via-chatflows-apikey-endpoint | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| flowiseai flowise | < 3.1.2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |