high

CVE-2026-70475

npm · flowise

Summary

Flowise: Missing Authorization on Execution Update Endpoint

Severity
high
EPSS
0.5% (p39)
CWE
CWE-862
Also known as
GHSA-fm2f-4339-4p2f
Published
2026-08-04
Updated
2026-08-04

Advisory details

Flowise Security Audit Report

Date: 2026-03-17 Researcher: Dimpal Jadhav (jadhavdimpy@gmail.com) GitHub: https://github.com/Dimpyj1604 Target: FlowiseAI/Flowise (latest main branch) Version: flowise-components@3.1.0

FINDING 1: Missing Authorization on Execution Update Endpoint

Severity: HIGH (CVSS ~7.5) Type: CWE-862 (Missing Authorization) File: packages/server/src/routes/executions/index.ts:11

Description: The PUT /api/v1/executions/:id endpoint lacks the checkAnyPermission() middleware that protects all other execution endpoints (GET, DELETE). Any authenticated user — regardless of their assigned permissions — can modify any execution record.

Evidence:

// Line 7 - GET has permission check
router.get('/', checkAnyPermission('executions:view'), executionController.getAllExecutions)

// Line 11 - PUT has NO permission check
router.put(['/', '/:id'], executionController.updateExecution)  // <-- MISSING checkAnyPermission

// Line 14 - DELETE has permission checkadvisory_1_execution_auth_bypass
router.delete('/:id', checkAnyPermission('executions:delete'), executionController.deleteExecutions)

Impact: Privilege escalation. A low-privileged user with any valid API key can modify execution state, data, and metadata of any execution in their workspace. Could be used to manipulate workflow execution results or inject data.

Reproduction:

curl -X PUT https://TARGET/api/v1/executions/EXECUTION_ID \
  -H "Authorization: Bearer LOW_PRIV_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"state": "FINISHED", "data": "MANIPULATED"}'

References

Related advisories

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPTClaudePerplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.