CVE-2026-50173: Flow-Like: Azure invoke presign grants app content write SAS to ExecuteEvents-only users
Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, GET /api/v1/apps/{appid}/invoke/presign grants Azure Blob Storage SAS credentials with write and delete access to app content to any app member that has ExecuteEvents, even when that member lacks ReadFiles and WriteFiles. The route treats file permissions as optional after the ExecuteEvents gate. When the caller has neither file permission, it selects CredentialsAccess::InvokeNone. In the Azure credential provider, InvokeNone still mints a contentsastoken for apps/{appid} with sp=rwdl, plus user-content and log SAS tokens. The returned shared credential is enough for the low-privilege caller to directly write or delete blobs under the app content prefix. Version 1.0.4 patches the issue. Flow-Like Studio and the hosted Flow-Like Web App are not affected. These deployments use AWS-backed storage. Self-hosted deployments are only affected if they use Azure Blob Storage as the storage backend. In affected deployments, the issue only applies to authenticated app members who have workflow execution permissions but should not have app file write/delete permissions. Users of affected self-hosted Azure deployments should update to version 1.0.4 or the latest dev branch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Flow-Like (self-hosted Azure deployments using Azure Blob Storage backend)to a version that resolves this vulnerability.Fixed in 1.0.4
Event History
Frequently Asked Questions
Which deployments need remediation?
Only self-hosted Flow-Like deployments using Azure Blob Storage are affected. Flow-Like Studio and the hosted Flow-Like Web App are not affected because they use AWS-backed storage.
What access would an attacker need?
The attacker must be an authenticated member of the target app with ExecuteEvents permission. The issue is relevant where that member is intentionally not granted ReadFiles or WriteFiles permissions.
What can a qualifying user do with the returned credentials?
They can obtain Azure Blob Storage SAS credentials that permit direct writes and deletions under the app content prefix. The content SAS token is issued with read, write, delete, and list permissions.
How can I determine whether a user may have been able to exploit this?
Check whether the deployment ran a version earlier than 1.0.4 with Azure Blob Storage configured, and identify app members with ExecuteEvents but without ReadFiles and WriteFiles. Those users could request the invoke presign endpoint and receive the over-privileged credentials.
What is the available fix?
Upgrade Flow-Like to version 1.0.4, which patches the issue.