CVE-2026-100610: Flowise through 3.1.4 Missing Authorization via upsert-history
Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspace or ownership validation. getAllUpsertHistory() returns UpsertHistory rows selected solely by an attacker-supplied chatflowid, and patchDeleteUpsertHistory() deletes rows by an attacker-supplied array of record UUIDs. As a result, any authenticated low-privilege user or valid API key can read or delete document-store upsert history belonging to other users and other workspaces whenever the target chatflowId (which is exposed publicly in /chatbot/<chatflowId> share links) or row ids are known. The retrievable flowData and result fields contain embedding, record-manager and vector-store node configuration, including per-node paramValues. No patched version is available.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated low-privilege Flowise user or holder of a valid API key can exploit it. The attacker does not need to belong to the target user's workspace.
What information does an attacker need?
To read history, the attacker needs a target chatflowId; these IDs may be publicly exposed in /chatbot/<chatflowId> share links. To delete history, the attacker needs the UUIDs of the target upsert-history records.
What data can be exposed or modified?
An attacker can retrieve document-store upsert history, including flowData and result fields. These fields can include embedding, record-manager, and vector-store node configuration, including per-node paramValues; the attacker can also delete targeted history rows.
Are default access boundaries sufficient to prevent cross-workspace access?
No. The affected routes lack route-level permission checks, and the backing service does not validate workspace membership or ownership. Authentication is required, but it does not restrict access to the attacker's own workspace or records.
What can be done if patching is not possible?
No patched version is available. Limit access to Flowise accounts and API keys, review and restrict exposure of public chatbot share links where possible, and treat chatflow IDs and upsert-history record UUIDs as sensitive identifiers.