CVE-2026-100605 — Flowise through 3.1.4 Missing Authorization via Chat Message Routes
Flowise through 3.1.4 contains missing route-level RBAC checks on chat message endpoints that allow low-privileged API keys to read and delete chat history. Attackers with valid…
Published: 2026-09-26 · CVSS: 7.5 · CVSS 4.0
Flowise through 3.1.4 contains missing route-level RBAC checks on chat message endpoints that allow low-privileged API keys to read and delete chat history. Attackers with valid but low-privileged API keys can access GET and DELETE chat message routes without required flow permissions to read chat histories, prompts, model responses, and delete messages.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7