CVE-2026-100605: Flowise through 3.1.4 Missing Authorization via Chat Message Routes
Flowise through 3.1.4 contains missing route-level RBAC checks on chat message endpoints that allow low-privileged API keys to read and delete chat history. Attackers with valid but low-privileged API keys can access GET and DELETE chat message routes without required flow permissions to read chat histories, prompts, model responses, and delete messages.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a valid low-privileged Flowise API key. No flow permissions are required for the affected chat message routes.
What data and actions are exposed through the affected routes?
The affected GET routes can expose chat histories, prompts, and model responses. The affected DELETE routes can delete chat messages.
Does exploitation require user interaction?
Yes. The provided severity vector indicates user interaction is required, although the available information does not specify what interaction is involved.
Which Flowise versions are known to be affected?
Flowise through version 3.1.4 is identified as affected.