CVE-2026-67621

Flowise through version 3.1.4 contains a missing authorization flaw (CWE-862) in which the document store's upsert and refresh mutation endpoints are not protected by permission checks. Any authenticated workspace member, including users holding only view-level permissions, can send direct HTTP requests to these routes to trigger document ingestion and refresh vector database contents. This allows a low-privileged insider to modify knowledge bases that downstream chatflows depend on and to consume the organization's embedding API credits through repeated forced re-ingestion. All Flowise deployments at or below 3.1.4 — typically self-hosted by AI/LLM development teams — are affected where untrusted users have any workspace access. A public proof-of-concept write-up exists, but exploitation probability is currently low (EPSS 0.3%, 20th percentile), there is no CISA KEV listing, and no in-the-wild exploitation has been reported.

What to do: Upgrade to a Flowise release newer than 3.1.4 as soon as a patched version is available. In the interim, restrict workspace membership and invite/role assignment to trusted users, and place Flowise behind an authenticated reverse proxy or network boundary so untrusted users cannot reach the API directly. Review document-store change history and embedding API usage/billing for unexpected upsert or refresh activity, and audit chatflow knowledge bases that view-only users could access for unauthorized modifications.