CVE-2026-70473 Details
Description
Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or workspace. The response can exceed 100MB and includes sensitive configuration data, including Vector Store settings such as Qdrant Server URL and collection name. The observed behavior indicates missing or insufficient authorization checks, workspace/project/tenant isolation, and pagination or limits, exposing integration parameters and infrastructure details that may enable further targeted attacks. This issue is fixed in version 3.1.3.
A vulnerability in Flowise prior to version 3.1.3 allows the Upsert History API to return excessive server-wide data instead of being limited to the requesting user's context. This flaw can lead to the unintentional disclosure of sensitive configuration information, such as Vector Store settings, including URLs and collection names, potentially facilitating targeted attacks. The issue arises from inadequate authorization checks and a lack of proper workspace or tenant isolation, allowing for the exposure of integration parameters and infrastructure details. Additionally, the response can exceed 100MB, creating challenges in data handling and processing.
Users can update to Flowise version 3.1.3 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-fr6g-7cq8-fg82 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/FlowiseAI/Flowise/commit/d81483b70c997ddf981acc9c49fbd9a02fa345cd | [email protected] | Patch |
| https://github.com/FlowiseAI/Flowise/pull/6170 | [email protected] | Issue TrackingPatch |
| https://github.com/FlowiseAI/Flowise/releases/tag/[email protected] | [email protected] | Release Notes |
| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-fr6g-7cq8-fg82 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-202 | Exposure of Sensitive Information Through Data Queries | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| flowiseai flowise | < 3.1.3 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 11, 2026 | Initial Analysis | [email protected] |
| Aug 4, 2026 | CVE Modified | CISA-ADP |
| Aug 4, 2026 | New CVE Received | [email protected] |