CVE-2026-71962

Flowise versions 2.2.4 through 3.1.4 contain a missing-authorization flaw (CWE-862) in the POST /api/v1/openai-assistants-file/download endpoint, which is listed in the product's global authentication whitelist and therefore skips all session and API key verification. An unauthenticated attacker can call the endpoint with valid chatflowId, chatId, and fileName identifiers to download files from any chatflow on the instance, including private chatflows belonging to other workspaces or organizations. The attacker gains unauthorized read access to potentially sensitive chatbot files, crossing user, workspace, and organization boundaries with no privileges or user interaction required. Any deployment running an affected Flowise version is exposed, particularly self-hosted instances reachable over a network by untrusted users. Exploitation has not been confirmed in the wild: the flaw is not in CISA KEV, EPSS assigns a 0.7% 30-day exploitation probability, and one public proof-of-concept is available.

What to do: Upgrade Flowise to a patched release newer than 3.1.4; as an interim mitigation, remove POST /api/v1/openai-assistants-file/download from the global authentication whitelist or restrict network access to the instance. Review access logs for unauthenticated calls to this endpoint and treat files served by any chatflow, including other workspaces' private ones, as potentially disclosed.