CVE-2026-71962: Flowise 2.2.4 - 3.1.4 Missing Authorization via openai-assistants-file/download
Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint that allows unauthenticated attackers to access private files by exploiting the endpoint's inclusion in the global authentication whitelist, which bypasses all session and API key verification. Attackers can supply valid chatflowId, chatId, and fileName identifiers to retrieve files from any chatflow on the instance, including private chatflows belonging to other workspaces or organizations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Flowiseto a version that resolves this vulnerability.Fixed in 2.2.4 - 3.1.4Patch Missing Authorization via openai-assistants-file/download - Configuration
Remove the POST /api/v1/openai-assistants-file/download endpoint from the global authentication whitelist so it no longer bypasses session and API key verification.
Flowise (POST /api/v1/openai-assistants-file/download) global authentication whitelist = exclude /api/v1/openai-assistants-file/download - Compensating control
Restrict network/instance access to the Flowise API endpoints (including POST /api/v1/openai-assistants-file/download) to trusted users/sources to reduce exposure to unauthenticated attackers.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71962?
CVE-2026-71962 has a severity rating of high, with a score of 7.5 on the CVSS scale.
How do I fix CVE-2026-71962?
To fix CVE-2026-71962, upgrade Flowise to version 3.1.5 or later where the missing authorization vulnerability is addressed.
What kind of files can be accessed due to CVE-2026-71962?
CVE-2026-71962 allows unauthorized access to private files through the vulnerable endpoint.
What are the affected versions of Flowise for CVE-2026-71962?
The affected versions of Flowise for CVE-2026-71962 are 2.2.4 through 3.1.4.
Who is affected by CVE-2026-71962?
Any user of Flowise versions 2.2.4 to 3.1.4 who relies on the API endpoint is potentially affected by CVE-2026-71962.