CVE-2026-69252

Description

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authenticated API key with unrelated permissions could call GET /api/v1/files to list files under the organization storage root and DELETE /api/v1/files?path=... to delete files belonging to other workspaces in the same organization because getAllFiles and deleteFile used activeOrganizationId and a user-controlled path without restricting access by permissions or activeWorkspaceId. This issue is fixed in version 3.1.3.

Overview

State: PUBLISHED
Assigner (CNA): GitHub_M
CVSS severity: HIGH
CVSS score: 7.2 / 10
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
Effective score: 7.2 / 10 HIGH source: CNA overview
CWE(s): CWE-862
Reserved: 2026-08-03
Published: 2026-08-04 14:53 UTC
Last updated: 2026-08-04 16:43 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/69xxx/CVE-2026-69252.json
Linked Threat: CVE-2026-69252 — Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-08-04 16:16:28 UTC
NVD last modified: 2026-08-04 17:17:00 UTC
EPSS score: 0.0026 (probability of exploitation in next 30 days)
EPSS percentile: 17.60% vs all CVEs — higher = more likely to be exploited, as of 2026-08-05

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-52726
Assigner: GitHub_M
Published: Aug 4, 2026, 2:53:59 PM
Updated: Aug 4, 2026, 4:43:11 PM
EUVD base score (CVSS 4.0): 7.2 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
EUVD-reported EPSS: 0.0000
Vendors: FlowiseAI
Products: Flowise (< 3.1.3)
Aliases: GHSA-wp74-f5hh-5f3r

ENISA description: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authenticated API key with unrelated permissions could call GET /api/v1/files to list files under the organization storage root and DELETE /api/v1/files?path=... to delete files belonging to other workspaces in the same organization because getAllFiles and deleteFile used activeOrganizationId and a user-controlled path without restricting access by permissions or activeWorkspaceId. This issue is fixed in version 3.1.3.

EUVD references (4)

Affected products (1)

Vendor	Product	Versions	Platforms
FlowiseAI	Flowise	`< 3.1.3` (affected)	—

Vendor references (4)

References embedded in the original CVE record by the assigning CNA.

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wp74-f5hh-5f3r x_refsource_CONFIRM
https://github.com/FlowiseAI/Flowise/pull/6435 x_refsource_MISC
https://github.com/FlowiseAI/Flowise/commit/bc22bf8baec95b6a3d6e1b3563b4f03491cd6fbb x_refsource_MISC
https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3 x_refsource_MISC

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (5)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://github.com/FlowiseAI/Flowise/commit/bc22bf8baec95b6a3d6e1b3563b4f03491cd6fbb security-advisories@github.com
https://github.com/FlowiseAI/Flowise/pull/6435 security-advisories@github.com
https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3 security-advisories@github.com
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wp74-f5hh-5f3r security-advisories@github.com
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wp74-f5hh-5f3r 134c704f-9b21-4f2e-91b3-4a467353bcc0

Remediations (10)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Nvd - Cve-2026-69252

web:nvd.nist.gov

Quick Info CVE Dictionary Entry: CVE-2026-69252 NVD Published Date: 08/04/ 2026 NVD Last Modified: 08/04/ 2026 Source: GitHub, Inc.

2026-08-06 01:14 UTC
CVE-2026-69252: CWE-862 | O3 Security

web:o3.security

Remediation status No patched version of the affected component has shipped for CVE-2026-69252 yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation .

2026-08-06 01:14 UTC
Vulnerability Remediation vs Mitigation: Which Strategy Wins in ...

web:securityboulevard.com

Organizations must decide how to tackle vulnerabilities—through remediation , mitigation , or a combination of both. But which strategy is more effective? This blog explores the nuances of vulnerability remediation vs mitigation , their respective benefits, and how to choose the right approach.

2026-08-06 01:14 UTC
SAP Security Patch Day - February 2026

web:support.sap.com

SAP security Patch Day Bulletin This post shares the information on security notes that remediate vulnerabilities discovered in SAP products. SAP strongly recommends that the customer visits the Support Portal and applies patches on priority to protect their SAP landscape. On 10th of February 2026 , SAP security patch day saw the release of 26 new security notes. Further, there was 1 update to ...

2026-08-06 01:14 UTC
SAP Security Patch Day - June 2026

web:support.sap.com

SAP security Patch Day Bulletin This post shares the information on security notes that remediate vulnerabilities discovered in SAP products. SAP strongly recommends that the customer visits the support portal and applies patches on priority to protect their SAP landscape. On 9th of June 2026 , SAP security patch day saw the release of 15 new security notes.

2026-08-06 01:14 UTC
CISA Adds Two Known Exploited Vulnerabilities to Catalog

web:www.cisa.gov

BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities.

2026-08-06 01:14 UTC
Patch Smarter, Not Harder - CISA

web:www.cisa.gov

The median time for full resolution rose to 43 days. Defenders need greater clarity and speed to patch systems in today's threat landscape. We must flip the script on patching prioritization: patch smarter, not harder.

2026-08-06 01:14 UTC
Oracle Critical Security Patch Update Advisory - June 2026

web:www.oracle.com

Additional CVEs addressed are: The patch for CVE - 2026 -34481 also addresses CVE - 2026 -34477, CVE - 2026 -34478, CVE - 2026 -34479, and CVE - 2026 -34480. Oracle Fusion Middleware Risk Matrix This Critical Security Patch Update contains 106 new security patches for Oracle Fusion Middleware. 53 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a ...

2026-08-06 01:14 UTC
Patch Tuesday - June 2026 - Rapid7

web:www.rapid7.com

Microsoft is publishing 200 vulnerabilities on June 2026 Patch Tuesday, including an HTTP/2 denial of service vulnerability and an elevation of privilege vulnerability in PowerToys.

2026-08-06 01:14 UTC
Patch Tuesday August 2026: Security Updates & CVE Analysis

web:zecurit.com

Get the complete breakdown of Microsoft's August 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

2026-08-06 01:14 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-69252.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-69252",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-04T16:42:34.859519Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-04T16:43:11.797Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wp74-f5hh-5f3r"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Flowise",
          "vendor": "FlowiseAI",
          "versions": [
            {
              "status": "affected",
              "version": "< 3.1.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authenticated API key with unrelated permissions could call GET /api/v1/files to list files under the organization storage root and DELETE /api/v1/files?path=... to delete files belonging to other workspaces in the same organization because getAllFiles and deleteFile used activeOrganizationId and a user-controlled path without restricting access by permissions or activeWorkspaceId. This issue is fixed in version 3.1.3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-04T14:53:59.791Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wp74-f5hh-5f3r",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wp74-f5hh-5f3r"
        },
        {
          "name": "https://github.com/FlowiseAI/Flowise/pull/6435",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FlowiseAI/Flowise/pull/6435"
        },
        {
          "name": "https://github.com/FlowiseAI/Flowise/commit/bc22bf8baec95b6a3d6e1b3563b4f03491cd6fbb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FlowiseAI/Flowise/commit/bc22bf8baec95b6a3d6e1b3563b4f03491cd6fbb"
        },
        {
          "name": "https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3"
        }
      ],
      "source": {
        "advisory": "GHSA-wp74-f5hh-5f3r",
        "discovery": "UNKNOWN"
      },
      "title": "Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-69252",
    "datePublished": "2026-08-04T14:53:59.791Z",
    "dateReserved": "2026-08-03T19:54:19.853Z",
    "dateUpdated": "2026-08-04T16:43:11.797Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}