Missing Authorization in Flowise - CVE-2026-70475
Published: July 30, 2026
Vulnerability identifier: #VU140078
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-70475
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to modify execution records.
The vulnerability exists due to missing authorization in the PUT /api/v1/executions/:id endpoint when handling execution update requests. A remote user can send a crafted PUT request with a valid API key to modify execution records.
This issue affects authenticated users regardless of their assigned execution permissions and is limited to execution records in their workspace.
Affected software
Flowise
How to mitigate CVE-2026-70475
Install security update from vendor's website.
Flowise - update to 3.1.3