CVE-2026-69262 Details
Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, `DELETE /api/v1/chatflows/:id` authorized requests with checkAnyPermission('chatflows:delete,agentflows:delete'), so possession of either permission was sufficient to reach the delete path. The delete logic then resolved the target record only by id and workspaceId and did not validate the target resource type, allowing a caller with only agentflows:delete to delete a CHATFLOW and a caller with only chatflows:delete to delete an AGENTFLOW in the same workspace. This issue is fixed in version 3.1.3.
A vulnerability exists in Flowise versions prior to 3.1.3, specifically in the `DELETE /api/v1/chatflows/:id` endpoint. The issue arises because the endpoint authorizes requests based on the possession of either `chatflows:delete` or `agentflows:delete` permissions, without validating the resource type being deleted. This flaw allows users with only `agentflows:delete` permission to delete `CHATFLOW` resources, and vice versa, disrupting the intended role-based access control (RBAC) separation between Chatflows and Agentflows. The vulnerability can be exploited by sending a delete request for a chatflow while holding an agentflow deletion permission, leading to unauthorized deletion and loss of configuration.
Users should update to Flowise version 3.1.3 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-p5w8-m249-4r4v | CISA-ADP | ExploitVendor Advisory |
| https://github.com/FlowiseAI/Flowise/commit/2f528ceced74afaa95fc7a282965e7788796448b | [email protected] | Patch |
| https://github.com/FlowiseAI/Flowise/pull/6445 | [email protected] | Issue TrackingPatch |
| https://github.com/FlowiseAI/Flowise/releases/tag/[email protected] | [email protected] | PatchRelease Notes |
| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-p5w8-m249-4r4v | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| flowiseai flowise | < 3.1.3 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | Initial Analysis | [email protected] |
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 4, 2026 | New CVE Received | [email protected] |