{"uuid": "f3838382-906c-4c5e-9f72-658c091abddd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69252", "type": "seen", "source": "https://gist.github.com/alon710/2dd72db9fde8130e6ba6e6299e77ffd0", "content": "# CVE-2026-69252: CVE-2026-69252: Broken Workspace Isolation and Missing Authorization in Flowise File Management API\n\n> **CVSS Score:** 7.2\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69252\n\n## Summary\nCVE-2026-69252 represents a missing authorization check (CWE-862) in the files API route (`/api/v1/files`) of Flowise, a drag-and-drop user interface for building LLM flows. Prior to version 3.1.3, an authenticated API key or user could list, access, and delete files across arbitrary workspaces inside an organization, completely bypassing workspace logical boundaries.\n\n## TL;DR\nFlowise prior to 3.1.3 allows authenticated users with low-privilege API keys to read and delete files across different workspaces due to missing authorization checks on the `/api/v1/files` endpoint.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 7.2 (High)\n- **Exploit Status**: PoC (Proof-of-Concept)\n- **Impact**: Confidentiality (High), Availability (High)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Flowise LLM Orchestration Platform\n- **Flowise**: < 3.1.3 (Fixed in: `3.1.3`)\n\n## Mitigation\n\n- Upgrade Flowise to version 3.1.3 or higher\n- Manually disable the vulnerable `/files` routes in source files if upgrading is delayed\n- Implement WAF rules to block GET and DELETE requests to `/api/v1/files`\n\n**Remediation Steps:**\n1. Verify current Flowise version by running `npm list -g flowise`\n2. Upgrade the package globally using `npm install -g flowise@3.1.3`\n3. Restart the Flowise service to apply changes\n4. Validate that requests to `/api/v1/files` return an HTTP 404 response\n\n## References\n\n- [GitHub Security Advisory: Missing Authorization on /api/v1/files](https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wp74-f5hh-5f3r)\n- [Flowise Pull Request #6435](https://github.com/FlowiseAI/Flowise/pull/6435)\n- [Flowise Patch Commit bc22bf8baec95b6a3d6e1b3563b4f03491cd6fbb](https://github.com/FlowiseAI/Flowise/commit/bc22bf8baec95b6a3d6e1b3563b4f03491cd6fbb)\n- [Flowise v3.1.3 Release Tag](https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69252) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T15:32:39.452795Z"}