CVE-2026-56268

Flowise before 3.1.2 contains an information disclosure vulnerability in the /api/v1/chatflows/apikey/:apikey endpoint. When the keyonly query parameter is omitted (the default), the endpoint returns not only the chatflows bound to the supplied API key but also all chatflows across every workspace that have no API key assigned, because the underlying query lacks any workspace filter. An attacker with a valid API key for one workspace can therefore retrieve the full ChatFlow configuration (including flowData with system prompts and node configurations, chatbotConfig, apiConfig, and credential IDs) of unprotected chatflows belonging to other workspaces.

• CWE-863

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-c2c9-mfw7-p8hwExploit, Third Party Advisory
• https://www.vulncheck.com/advisories/flowise-cross-workspace-information-disclosure-via-chatflows-apikey-endpointThird Party Advisory
• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-c2c9-mfw7-p8hwExploit, Third Party Advisory

Published

Jun 22, 2026

Last Modified

Jun 25, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-56262Crawl4AI before 0.8.7 contains an authentication bypass vuln…6.5
• CVE-2026-56263Crawl4AI before 0.8.7 contains a stored cross-site scripting…6.1
• CVE-2026-56264Crawl4AI before 0.8.7 contains an arbitrary JavaScript execu…6.1
• CVE-2026-56265Crawl4AI before 0.8.7 contains an authentication bypass vuln…9.8
• CVE-2026-56266Crawl4AI before 0.8.7 contains a server-side request forgery…8.6
• CVE-2026-56267Flowise before 3.0.13 contains an information exposure vulne…6.9
• CVE-2026-56269Flowise before 3.1.0 (npm package flowise, versions 3.0.13 a…4.6
• CVE-2026-5627A path traversal vulnerability exists in mintplex-labs/anyth…7.2
• CVE-2026-56270Flowise before 3.1.0 (versions 3.0.13 and earlier) contains …7.5
• CVE-2026-56271Flowise before 3.1.0 (affected versions 3.0.13 and earlier) …9.8
• CVE-2026-56272Flowise before 3.0.13 uses bcrypt with default salt rounds o…5.6
• CVE-2026-56273Flowise before 3.1.0 contains a path traversal vulnerability…6.5