CVE-2026-69252: Flowise missing authz

Q: Is CVE-2026-69252 actively exploited?

No confirmed active exploitation of CVE-2026-69252 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-69252?

Upgrade to Flowise 3.1.3 or later immediately, where checkPermission and activeWorkspaceId scoping are enforced on the /api/v1/files route. If immediate upgrade isn't possible, restrict or disable the feat:files feature gate for API keys that don't strictly need file access, and front the endpoint with an API gateway rule that validates workspace ownership before forwarding GET/DELETE calls. For detection, audit Flowise access logs for GET /api/v1/files or DELETE /api/v1/files?path= calls where the requesting API key's associated workspace differs from the file path's workspace prefix, and alert on any DELETE calls targeting paths outside the caller's known workspace.

Q: What systems are affected by CVE-2026-69252?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, multi-tenant SaaS deployments.

Q: What is the CVSS score for CVE-2026-69252?

No CVSS score has been assigned yet.

CISO Take

Flowise, an open-source drag-and-drop builder for LLM workflows, shipped an authorization bug in its /api/v1/files endpoint where GET and DELETE requests were gated only by a feature flag rather than by proper permission and workspace checks. Any authenticated API key in the organization — even one issued for an unrelated, low-privileged purpose — could enumerate every file under the organization's storage root and delete files belonging to workspaces it has no business touching, purely by supplying a user-controlled path parameter. There's no public exploit or scanner template yet and EPSS sits at a low 0.26%, but CISA's SSVC decision is ATTEND and the flaw requires zero sophistication once an attacker holds any valid API key, which is a realistic bar in multi-tenant Flowise deployments with several teams sharing an organization. Since Flowise chains 158 historical CVEs and this package has a 0/100 internal risk score, treat any exposed instance as high-priority technical debt. Patch to Flowise 3.1.3 immediately; until then, review which API keys have the files feature enabled and audit `activeOrganizationId`-scoped file operations in logs for deletions or listings that don't match the key's expected workspace.

Sources: NVD GitHub Advisory EPSS ATLAS

What is the risk?

Moderate-to-high risk for multi-tenant Flowise deployments. Exploitability is trivial for anyone who already holds a valid, low-privileged API key in the target organization — no code execution, injection, or AI-specific trickery is needed, just a crafted GET/DELETE call. The blast radius is bounded to organizations that share one Flowise instance across multiple workspaces/teams, which is common in enterprise self-hosted deployments. No CISA KEV listing and no public PoC lower near-term mass-exploitation likelihood (EPSS top 82th percentile, still low absolute probability), but the missing-authorization class (CWE-862) is easy to weaponize once identified, and SSVC ATTEND signals CISA considers it worth tracking for patch prioritization.

How does the attack unfold?

Initial Access

Attacker obtains or already holds a valid, low-privileged Flowise API key scoped to unrelated permissions within the target organization.

AML.T0012

Discovery

Attacker calls GET /api/v1/files, which enforces only a feature-flag check and no permission or workspace scoping, to enumerate files across the entire organization storage root.

AML.T0037

Impact

Attacker calls DELETE /api/v1/files?path=... targeting files belonging to other workspaces in the same organization, destroying RAG source data or flow assets outside their authorized scope.

Initial Access

Attacker obtains or already holds a valid, low-privileged Flowise API key scoped to unrelated permissions within the target organization.

AML.T0012

Discovery

Attacker calls GET /api/v1/files, which enforces only a feature-flag check and no permission or workspace scoping, to enumerate files across the entire organization storage root.

AML.T0037

Impact

Attacker calls DELETE /api/v1/files?path=... targeting files belonging to other workspaces in the same organization, destroying RAG source data or flow assets outside their authorized scope.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	<= 3.1.2	`3.1.3`

Do you use Flowise? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.4%

chance of exploitation in 30 days

Higher than 29% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What should I do?

1 step

Upgrade to Flowise 3.1.3 or later immediately, where checkPermission and activeWorkspaceId scoping are enforced on the /api/v1/files route. If immediate upgrade isn't possible, restrict or disable the feat:files feature gate for API keys that don't strictly need file access, and front the endpoint with an API gateway rule that validates workspace ownership before forwarding GET/DELETE calls. For detection, audit Flowise access logs for GET /api/v1/files or DELETE /api/v1/files?path= calls where the requesting API key's associated workspace differs from the file path's workspace prefix, and alert on any DELETE calls targeting paths outside the caller's known workspace.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Agent Framework AML.T0012 - Valid Accounts AML.T0025 - Exfiltration via Cyber Means AML.T0037 - Data from Local System

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MANAGE 4.1 - Risk treatment and monitoring for third-party/deployed AI systems

OWASP LLM Top 10

LLM02 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-69252?

Flowise, an open-source drag-and-drop builder for LLM workflows, shipped an authorization bug in its /api/v1/files endpoint where GET and DELETE requests were gated only by a feature flag rather than by proper permission and workspace checks. Any authenticated API key in the organization — even one issued for an unrelated, low-privileged purpose — could enumerate every file under the organization's storage root and delete files belonging to workspaces it has no business touching, purely by supplying a user-controlled path parameter. There's no public exploit or scanner template yet and EPSS sits at a low 0.26%, but CISA's SSVC decision is ATTEND and the flaw requires zero sophistication once an attacker holds any valid API key, which is a realistic bar in multi-tenant Flowise deployments with several teams sharing an organization. Since Flowise chains 158 historical CVEs and this package has a 0/100 internal risk score, treat any exposed instance as high-priority technical debt. Patch to Flowise 3.1.3 immediately; until then, review which API keys have the files feature enabled and audit `activeOrganizationId`-scoped file operations in logs for deletions or listings that don't match the key's expected workspace.

Is CVE-2026-69252 actively exploited?

No confirmed active exploitation of CVE-2026-69252 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-69252?

Upgrade to Flowise 3.1.3 or later immediately, where checkPermission and activeWorkspaceId scoping are enforced on the /api/v1/files route. If immediate upgrade isn't possible, restrict or disable the feat:files feature gate for API keys that don't strictly need file access, and front the endpoint with an API gateway rule that validates workspace ownership before forwarding GET/DELETE calls. For detection, audit Flowise access logs for GET /api/v1/files or DELETE /api/v1/files?path= calls where the requesting API key's associated workspace differs from the file path's workspace prefix, and alert on any DELETE calls targeting paths outside the caller's known workspace.

What systems are affected by CVE-2026-69252?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, multi-tenant SaaS deployments.

What is the CVSS score for CVE-2026-69252?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesmulti-tenant SaaS deployments

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0025 Exfiltration via Cyber Means

AML.T0037 Data from Local System

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MANAGE 4.1

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authenticated API key with unrelated permissions could call GET /api/v1/files to list files under the organization storage root and DELETE /api/v1/files?path=... to delete files belonging to other workspaces in the same organization because getAllFiles and deleteFile used activeOrganizationId and a user-controlled path without restricting access by permissions or activeWorkspaceId. This issue is fixed in version 3.1.3.

Exploitation Scenario

An attacker who has legitimate but limited access to a Flowise organization — for example, an intern or a compromised low-privilege integration key meant only for triggering a specific chatflow — discovers the /api/v1/files endpoint is reachable with their existing API key. They call GET /api/v1/files and enumerate the full organization storage root, identifying files belonging to other teams' RAG pipelines and agent configurations. Recognizing no workspace-level check exists, they then issue DELETE /api/v1/files?path=<other-workspace-file> to destroy a competing team's ingested knowledge base documents or flow assets, causing data loss and downstream service disruption without ever needing elevated credentials.

Weaknesses (CWE)

CWE-862 Missing Authorization Primary CWE-862 Missing Authorization CWE-862 Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.