CVE-2026-69262
Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow type
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, `DELETE /api/v1/chatflows/:id` authorized requests with checkAnyPermission('chatflows:delete,agentflows:delete'), so possession of either permission was sufficient to reach the delete path. The delete logic then resolved the target record only by id and workspaceId and did not validate the target resource type, allowing a caller with only agentflows:delete to delete a CHATFLOW and a caller with only chatflows:delete to delete an AGENTFLOW in the same workspace. This issue is fixed in version 3.1.3.
| CWE | CWE-863 |
| Vendor | flowiseai |
| Product | flowise |
| Published | Aug 4, 2026 |
Stay Ahead of the Next One
Get instant alerts for flowiseai flowise
Be the first to know when new unknown vulnerabilities affecting flowiseai flowise are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
FlowiseAI / Flowise
< 3.1.3
References
github.com: https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-p5w8-m249-4r4v github.com: https://github.com/FlowiseAI/Flowise/pull/6445 github.com: https://github.com/FlowiseAI/Flowise/commit/2f528ceced74afaa95fc7a282965e7788796448b github.com: https://github.com/FlowiseAI/Flowise/releases/tag/[email protected]