CVE-2026-67621: Flowise broken authz lets viewers

CISO Take

Flowise (through 3.1.4) fails to enforce authorization on its document store mutation endpoints, so any authenticated workspace member with view-only permissions can call the upsert and refresh routes directly via HTTP and bypass the UI restrictions meant to block them. This matters because those endpoints control the vector database content that downstream chatflows retrieve and present to users — a low-privilege insider or a compromised low-tier account can silently rewrite the knowledge base, injecting misleading content into every chatbot response built on it, while also driving up embedding API spend through forced re-ingestion. The CVSS score of 7.6 reflects real integrity impact (C:L/I:H/A:L), but exploitation pressure is currently modest: EPSS sits at 0.27%, there is no CISA KEV listing, no public exploit code, and no Nuclei scanner template, and CISA's SSVC decision is TRACK*, not immediate action. Flowise carries 158 other tracked CVEs, signaling a broader pattern of insufficient hardening in this platform, so treat this less as an isolated bug and more as a prompt to review the product's overall access-control posture. Patch to the version beyond 3.1.4 referenced in the vendor advisory, and in the interim restrict workspace membership to trusted users and audit which accounts with view-only roles can reach document-store API routes.

Sources: NVD EPSS ATLAS vulncheck.com flowiseai.com

What is the risk?

Moderate-to-high organizational risk despite low exploitation telemetry. The flaw requires low privileges (PR:L) and no user interaction (UI:N), and is reachable over the network with low attack complexity — the only barrier is holding any authenticated workspace account, which in shared or multi-tenant Flowise deployments (agencies, internal platform teams, partner workspaces) is a low bar. Impact is concentrated on integrity of AI knowledge assets (document store content feeding chatflows) rather than direct system compromise, so this is best framed as an insider-abuse / RAG-integrity risk rather than a remote-unauthenticated critical. Absence from KEV, no public PoC, and sub-1% EPSS mean opportunistic mass exploitation is unlikely today, but the low skill bar (direct HTTP calls once endpoints are known) means a motivated insider or anyone who reads the linked technical write-up can reproduce it quickly.

How does the attack unfold?

Authenticated Workspace Access

Attacker obtains or already holds a low-privilege, view-only account in a shared Flowise workspace.

AML.T0012

Direct Endpoint Invocation

Attacker bypasses the UI's role-based restrictions by sending direct HTTP requests to the unprotected document store upsert and refresh mutation endpoints.

AML.T0049

Knowledge Base Poisoning

Injected or modified documents are ingested and re-embedded into the vector store, corrupting the RAG content served to downstream chatflows.

AML.T0070

Downstream Impact

End users of affected chatflows/agents receive poisoned responses, and the organization incurs unnecessary embedding API costs from forced refresh operations.

AML.T0034

Authenticated Workspace Access

Attacker obtains or already holds a low-privilege, view-only account in a shared Flowise workspace.

AML.T0012

Direct Endpoint Invocation

Attacker bypasses the UI's role-based restrictions by sending direct HTTP requests to the unprotected document store upsert and refresh mutation endpoints.

AML.T0049

Knowledge Base Poisoning

Injected or modified documents are ingested and re-embedded into the vector store, corrupting the RAG content served to downstream chatflows.

AML.T0070

Downstream Impact

End users of affected chatflows/agents receive poisoned responses, and the organization incurs unnecessary embedding API costs from forced refresh operations.

AML.T0034

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	—	No patch

Do you use Flowise? You're affected.

How severe is it?

CVSS 3.1

7.6 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 28% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C Low

I High

A Low

What should I do?

1 step

1) Upgrade Flowise past 3.1.4 per the vendor advisory (flowiseai.com/sunset) as soon as a patched build is confirmed available — note the advisory URL suggests the project may be winding down, so validate whether a maintained fork or successor is the actual remediation path. 2) Until patched, place a reverse-proxy/API-gateway authorization layer in front of Flowise that independently enforces role checks on /document-store/upsert and /document-store/refresh (or equivalent) routes rather than trusting the app's own UI-level gating. 3) Audit workspace membership and strip API-capable accounts down to the minimum needed; treat 'view-only' roles as non-trusted for API access until the fix lands. 4) Enable logging/alerting on document-store mutation calls and cross-reference caller role against the action — flag any mutation performed by an account provisioned as view-only. 5) After patching, force a full re-embed/refresh and manually review recent document store changes for unauthorized content.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Model Poisoning RAG Agent AML.T0034 - Cost Harvesting AML.T0059 - Erode Dataset Integrity AML.T0070 - RAG Poisoning

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 10 - Data and Data Governance

ISO 42001

A.6.2.6 - Data for AI systems

NIST AI RMF

MANAGE-2.3 - Mechanisms are in place to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use

OWASP LLM Top 10

LLM08:2025 - Vector and Embedding Weaknesses

Frequently Asked Questions

What is CVE-2026-67621?

Flowise (through 3.1.4) fails to enforce authorization on its document store mutation endpoints, so any authenticated workspace member with view-only permissions can call the upsert and refresh routes directly via HTTP and bypass the UI restrictions meant to block them. This matters because those endpoints control the vector database content that downstream chatflows retrieve and present to users — a low-privilege insider or a compromised low-tier account can silently rewrite the knowledge base, injecting misleading content into every chatbot response built on it, while also driving up embedding API spend through forced re-ingestion. The CVSS score of 7.6 reflects real integrity impact (C:L/I:H/A:L), but exploitation pressure is currently modest: EPSS sits at 0.27%, there is no CISA KEV listing, no public exploit code, and no Nuclei scanner template, and CISA's SSVC decision is TRACK*, not immediate action. Flowise carries 158 other tracked CVEs, signaling a broader pattern of insufficient hardening in this platform, so treat this less as an isolated bug and more as a prompt to review the product's overall access-control posture. Patch to the version beyond 3.1.4 referenced in the vendor advisory, and in the interim restrict workspace membership to trusted users and audit which accounts with view-only roles can reach document-store API routes.

Is CVE-2026-67621 actively exploited?

No confirmed active exploitation of CVE-2026-67621 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-67621?

1) Upgrade Flowise past 3.1.4 per the vendor advisory (flowiseai.com/sunset) as soon as a patched build is confirmed available — note the advisory URL suggests the project may be winding down, so validate whether a maintained fork or successor is the actual remediation path. 2) Until patched, place a reverse-proxy/API-gateway authorization layer in front of Flowise that independently enforces role checks on `/document-store/upsert` and `/document-store/refresh` (or equivalent) routes rather than trusting the app's own UI-level gating. 3) Audit workspace membership and strip API-capable accounts down to the minimum needed; treat 'view-only' roles as non-trusted for API access until the fix lands. 4) Enable logging/alerting on document-store mutation calls and cross-reference caller role against the action — flag any mutation performed by an account provisioned as view-only. 5) After patching, force a full re-embed/refresh and manually review recent document store changes for unauthorized content.

What systems are affected by CVE-2026-67621?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, vector databases, agent frameworks.

What is the CVSS score for CVE-2026-67621?

CVE-2026-67621 has a CVSS v3.1 base score of 7.6 (HIGH). The EPSS exploitation probability is 0.34%.

What is the AI security impact?

Affected AI Architectures

RAG pipelinesvector databasesagent frameworks

MITRE ATLAS Techniques

AML.T0034 Cost Harvesting

AML.T0059 Erode Dataset Integrity

AML.T0070 RAG Poisoning

Compliance Controls Affected

EU AI Act: Article 10

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE-2.3

OWASP LLM Top 10: LLM08:2025

What are the technical details?

Original Advisory

Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers holding only view-level permissions can send direct HTTP requests to the upsert and refresh document store routes to trigger document ingestion, refresh vector database contents, consume embedding API credits, and modify knowledge bases used by downstream chatflows.

Exploitation Scenario

An organization grants a contractor or junior analyst a 'viewer' role in a shared Flowise workspace so they can inspect chatflow outputs without editing anything. Instead of using the UI (where mutation buttons are hidden for their role), the attacker inspects the web app's network calls or the linked public technical write-up, then sends a direct authenticated POST request to the document store's upsert endpoint, injecting a crafted document containing misleading instructions or disinformation. They follow with a call to the refresh endpoint to force re-embedding, ensuring the poisoned content is indexed into the vector store. From that point, every chatflow or agent that retrieves from that document store surfaces the attacker's injected content to end users as if it were legitimate knowledge-base data, and the organization pays for the unnecessary embedding compute the attacker triggered.

Weaknesses (CWE)

CWE-862 Missing Authorization Primary CWE-862 Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.