CVE-2026-100610

Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspace or ownership validation. getAllUpsertHistory() returns UpsertHistory rows selected solely by an attacker-supplied chatflowid, and patchDeleteUpsertHistory() deletes rows by an attacker-supplied array of record UUIDs. As a result, any authenticated low-privilege user or valid API key can read or delete document-store upsert history belonging to other users and other workspaces whenever the target chatflowId (which is exposed publicly in /chatbot/<chatflowId> share links) or row ids are known. The retrievable flowData and result fields contain embedding, record-manager and vector-store node configuration, including per-node paramValues. No patched version is available.

• CWE-639

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-jvx3-mjpw-r4gh
• https://www.vulncheck.com/advisories/flowise-through-3.1.4-missing-authorization-via-upsert-history

Published

Sep 26, 2026

Last Modified

Sep 26, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-100605Flowise through 3.1.4 contains missing route-level RBAC chec…7.1
• CVE-2026-100606Flowise through 3.1.4 (Enterprise/platform mode with SSO ena…7.7
• CVE-2026-100607Flowise through 3.1.4 resolves SSO and local-password users …7.7
• CVE-2026-100608Flowise through 3.1.4 does not enforce authorization on the …8.3
• CVE-2026-100609Flowise (npm packages `flowise` and `flowise-components`) th…6.8
• CVE-2026-10061A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Af…9.8
• CVE-2026-100611Capgo (capgo.app backend, versions ≤ 12.261.0) improperly re…6.5
• CVE-2026-100612Capgo (capgo.app) through version 12.261.0 contains an incom…7.2
• CVE-2026-100613capgo.app is an over-the-air (OTA) update platform for Capac…5.3
• CVE-2026-100614Capgo before 12.244.1 contains a cross-tenant integrity vuln…8.8
• CVE-2026-100615Cap-go capgo.app before 12.267.1 fails to validate target AP…8.8
• CVE-2026-100616capgo.app is an over-the-air update platform for Capacitor a…5.5