DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-69262: CVE-2026-69262: Incorrect Authorization Flaw in Flowise Chatflow Deletion Endpoint

#security #cve #cybersecurity

CVE-2026-69262: Incorrect Authorization Flaw in Flowise Chatflow Deletion Endpoint

Vulnerability ID: CVE-2026-69262
CVSS Score: 7.1
Published: 2026-08-04

CVE-2026-69262 is a high-severity incorrect authorization vulnerability (CWE-863) within the Flowise drag-and-drop LLM flow platform. Prior to version 3.1.3, Flowise did not enforce resource-type validation on its deletion endpoint. Although routing middleware ensured users held deletion privileges for either chatflows or agentflows, the service level lacked validation checks to verify whether the target resource matched the user's specific permissions. Consequently, an authenticated user with only agentflow deletion permissions could delete arbitrary chatflow configurations, leading to unauthorized state modification and service disruption.

TL;DR

Flowise versions prior to 3.1.3 contain an incorrect authorization flaw allowing users with limited deletion permissions (e.g., agentflows only) to delete other flow types (e.g., chatflows) due to missing resource-type validation checks in the deletion service layer.

Technical Details

  • CWE ID: CWE-863
  • Attack Vector: Network (AV:N)
  • CVSS v4.0 Score: 7.1
  • EPSS Score: None recorded
  • Impact: High Availability Loss
  • Exploit Status: No public exploits
  • KEV Status: Not Listed

Affected Systems

  • Flowise Developer Tooling platform
  • Flowise: < 3.1.3 (Fixed in: 3.1.3)

Code Analysis

Commit: 2f528ce

Implement resource-type validation on chatflow deletion endpoint

Mitigation Strategies

  • Upgrade Flowise to version 3.1.3 or higher
  • Implement strict downstream database entity type checks inside controller logic
  • Audit multi-tenant workspace environments for unauthorized deletion attempts
  • Restrict user permission roles to trust boundaries until the upgrade is complete

Remediation Steps:

  1. Identify active Flowise platform deployments and evaluate their package versions
  2. Execute npm install -g flowise@3.1.3 to apply the server updates
  3. Restart the Flowise server processes to ensure the updated logic is executed
  4. Review API and reverse proxy logs for anomalous DELETE requests returning status code 200

References

Read the full report for CVE-2026-69262 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)