CVE-2026-69252: CVE-2026-69252: Broken Workspace Isolation and Missing Authorization in Flowise File Management API

CVE-2026-69252: Broken Workspace Isolation and Missing Authorization in Flowise File Management API

Vulnerability ID: CVE-2026-69252
CVSS Score: 7.2
Published: 2026-08-04

CVE-2026-69252 represents a missing authorization check (CWE-862) in the files API route (/api/v1/files) of Flowise, a drag-and-drop user interface for building LLM flows. Prior to version 3.1.3, an authenticated API key or user could list, access, and delete files across arbitrary workspaces inside an organization, completely bypassing workspace logical boundaries.

TL;DR

Flowise prior to 3.1.3 allows authenticated users with low-privilege API keys to read and delete files across different workspaces due to missing authorization checks on the /api/v1/files endpoint.

---

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-862
• Attack Vector: Network (AV:N)
• CVSS v4.0 Score: 7.2 (High)
• Exploit Status: PoC (Proof-of-Concept)
• Impact: Confidentiality (High), Availability (High)
• KEV Status: Not Listed

Affected Systems

• Flowise LLM Orchestration Platform
• Flowise: < 3.1.3 (Fixed in: 3.1.3)

Code Analysis

Commit: bc22bf8

Disable vulnerable files endpoint entirely on frontend and backend routes, blacklisting /api/v1/files in API keys configuration.

Exploit Details

• GitHub Security Advisory GHSA-wp74-f5hh-5f3r: Public advisory containing the vulnerability analysis and validation step steps for listing and deleting files using a low-privilege token.

Mitigation Strategies

• Upgrade Flowise to version 3.1.3 or higher
• Manually disable the vulnerable /files routes in source files if upgrading is delayed
• Implement WAF rules to block GET and DELETE requests to /api/v1/files

Remediation Steps:

1. Verify current Flowise version by running npm list -g flowise
2. Upgrade the package globally using npm install -g flowise@3.1.3
3. Restart the Flowise service to apply changes
4. Validate that requests to /api/v1/files return an HTTP 404 response

References

• GitHub Security Advisory: Missing Authorization on /api/v1/files
• Flowise Pull Request #6435
• Flowise Patch Commit bc22bf8baec95b6a3d6e1b3563b4f03491cd6fbb
• Flowise v3.1.3 Release Tag

---

Read the full report for CVE-2026-69252 on our website for more details including interactive diagrams and full exploit analysis.