CVE-2024-36421

Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, A CORS misconfiguration sets the Access-Control-Allow-Origin header to all, allowing arbitrary origins to connect to the website. In the default configuration (unauthenticated), arbitrary origins may be able to make requests to Flowise, stealing information from the user. This CORS misconfiguration may be chained with the path injection to allow an attacker attackers without access to Flowise to read arbitrary files from the Flowise server. As of time of publication, no known patches are available.

• CWE-346
• CWE-346

• https://github.com/FlowiseAI/Flowise/blob/e93ce07851cdc0fcde12374f301b8070f2043687/packages/server/src/index.ts#L122Product
• https://securitylab.github.com/advisories/GHSL-2023-232_GHSL-2023-234_Flowise/Exploit, Third Party Advisory
• https://github.com/FlowiseAI/Flowise/blob/e93ce07851cdc0fcde12374f301b8070f2043687/packages/server/src/index.ts#L122Product
• https://securitylab.github.com/advisories/GHSL-2023-232_GHSL-2023-234_Flowise/Exploit, Third Party Advisory

Published

Jul 1, 2024

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-36416SuiteCRM is an open-source Customer Relationship Management …7.5
• CVE-2024-36417SuiteCRM is an open-source Customer Relationship Management …9
• CVE-2024-36418SuiteCRM is an open-source Customer Relationship Management …8.8
• CVE-2024-36419SuiteCRM is an open-source Customer Relationship Management …6.1
• CVE-2024-3642The Newsletter Popup WordPress plugin through 1.2 does not h…6.9
• CVE-2024-36420Flowise is a drag & drop user interface to build a customize…7.5
• CVE-2024-36422Flowise is a drag & drop user interface to build a customize…6.1
• CVE-2024-36423Flowise is a drag & drop user interface to build a customize…6.1
• CVE-2024-36424K7RKScan.sys in K7 Ultimate Security before 17.0.2019 allows…5.5
• CVE-2024-36426In TARGIT Decision Suite 23.2.15007.0 before Autumn 2023, th…7.5
• CVE-2024-36427The file-serving function in TARGIT Decision Suite before 24…8.1
• CVE-2024-36428OrangeHRM 3.3.3 allows admin/viewProjects sortOrder SQL inje…8.1