Incorrect authorization in Flowise - CVE-2026-69262
Published: July 30, 2026
Vulnerability identifier: #VU140061
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-69262
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to delete flow resources outside their intended permission scope.
The vulnerability exists due to improper access control in DELETE /api/v1/chatflows/:id when handling delete requests for flow records. A remote user can send a delete request for a flow id associated with the other flow type to delete flow resources outside their intended permission scope.
This issue breaks the intended RBAC separation between Chatflows and Agentflows within the same workspace.
Affected software
Flowise
How to mitigate CVE-2026-69262
Install security update from vendor's website.
Flowise - update to 3.1.3