CVE-2026-67621 Details

A missing authorization vulnerability has been identified in Flowise versions through 3.1.4. This vulnerability allows authenticated workspace members with only view-level permissions to perform unauthorized operations on the document store by accessing unprotected mutation endpoints. The issue arises because two mutation endpoints responsible for document ingestion and refreshing vector database contents are registered without the necessary role-based access control (RBAC) middleware. As a result, attackers can send direct HTTP requests to these endpoints, triggering document ingestion, refreshing vector database contents, consuming embedding API credits, and modifying knowledge bases used by downstream chatflows.

To address this vulnerability, it is recommended to require 'documentStores:upsert-config' permission before all mutation endpoints. Additionally, permission checks should be executed before processing multipart file uploads to prevent unauthorized file handling.