This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-70473 | BDVDB-2026-355231 Detail

FlowiseAIFlowise

Description#

Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or workspace. The response can exceed 100MB and includes sensitive configuration data, including Vector Store settings such as Qdrant Server URL and collection name. The observed behavior indicates missing or insufficient authorization checks, workspace/project/tenant isolation, and pagination or limits, exposing integration parameters and infrastructure details that may enable further targeted attacks. This issue is fixed in version 3.1.3.

Impact#

Per CVSS v4.0: confidentiality impact high, integrity impact none, availability impact low. Attack vector: network.

Weaknesses#

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-202 Exposure of Sensitive Information Through Data Queries
  • CWE-862 Missing Authorization

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.