GHSA-fm2f-4339-4p2f: Npm/flowise vulnerability

Published Aug 4, 2026
·
Updated

Flowise Security Audit Report Date: 2026-03-17 Researcher: Dimpal Jadhav (jadhavdimpy@gmail.com) GitHub: https://github.com/Dimpyj1604 Target: FlowiseAI/Flowise (latest main branch) Version: flowise-components@3.1.0

FINDING 1: Missing Authorization on Execution Update Endpoint Severity: HIGH (CVSS ~7.5) Type: CWE-862 (Missing Authorization) File: packages/server/src/routes/executions/index.ts:11

Description: The PUT /api/v1/executions/:id endpoint lacks the checkAnyPermission() middleware that protects all other execution endpoints (GET, DELETE). Any authenticated user — regardless of their assigned permissions — can modify any execution record.

Evidence: typescript // Line 7 - GET has permission check router.get('/', checkAnyPermission('executions:view'), executionController.getAllExecutions)

// Line 11 - PUT has NO permission check router.put(['/', '/:id'], executionController.updateExecution) // <-- MISSING checkAnyPermission

// Line 14 - DELETE has permission checkadvisory1executionauthbypass router.delete('/:id', checkAnyPermission('executions:delete'), executionController.deleteExecutions)

Impact: Privilege escalation. A low-privileged user with any valid API key can modify execution state, data, and metadata of any execution in their workspace. Could be used to manipulate workflow execution results or inject data.

Reproduction: bash curl -X PUT https://TARGET/api/v1/executions/EXECUTIONID \ -H "Authorization: Bearer LOWPRIVAPIKEY" \ -H "Content-Type: application/json" \ -d '{"state": "FINISHED", "data": "MANIPULATED"}'

Affected Software

1 affected componentFixes available
npm/flowise<=3.1.2
3.1.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade npm/flowise to a version that resolves this vulnerability.

    Fixed in 3.1.3
  2. Configuration

    Update packages/server/src/routes/executions/index.ts so the PUT route that calls executionController.updateExecution includes the missing authorization middleware (checkAnyPermission), since other execution endpoints (GET/DELETE) are protected and PUT is currently not.

    Flowise server (packages/server/src/routes/executions/index.ts) Route middleware for PUT /api/v1/executions/:id (updateExecution) = Add checkAnyPermission('executions:edit') (or the appropriate executions permission used by other execution routes) before executionController.updateExecution

Event History

Aug 4, 2026
Advisory Published
via GitHub·07:18 PM
Data Sourced
via GitHub·07:18 PM
DescriptionWeaknessAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203