PT-2026-67919
Publicado
2026-08-04
·
Atualizado
2026-08-04
Descrição por
CVSS 4.0
7.1
AltaMétricasAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Flowise Security Audit Report
Date: 2026-03-17
Researcher: Dimpal Jadhav (jadhavdimpy@gmail.com)
GitHub: https://github.com/Dimpyj1604
Target: FlowiseAI/Flowise (latest main branch)
Version: flowise-components@3.1.0
FINDING 1: Missing Authorization on Execution Update Endpoint
Severity: HIGH (CVSS ~7.5)
Type: CWE-862 (Missing Authorization)
File:
packages/server/src/routes/executions/index.ts:11Description: The
PUT /api/v1/executions/:id endpoint lacks the checkAnyPermission() middleware that protects all other execution endpoints (GET, DELETE). Any authenticated user — regardless of their assigned permissions — can modify any execution record.Evidence:
typescript
// Line 7 - GET has permission check
router.get('/', checkAnyPermission('executions:view'), executionController.getAllExecutions)
// Line 11 - PUT has NO permission check
router.put(['/', '/:id'], executionController.updateExecution) // <-- MISSING checkAnyPermission
// Line 14 - DELETE has permission checkadvisory 1 execution auth bypass
router.delete('/:id', checkAnyPermission('executions:delete'), executionController.deleteExecutions)Impact: Privilege escalation. A low-privileged user with any valid API key can modify execution state, data, and metadata of any execution in their workspace. Could be used to manipulate workflow execution results or inject data.
Reproduction:
bash
curl -X PUT https://TARGET/api/v1/executions/EXECUTION ID
-H "Authorization: Bearer LOW PRIV API KEY"
-H "Content-Type: application/json"
-d '{"state": "FINISHED", "data": "MANIPULATED"}'Explorabilidade
Correção
Impactos
Fornecedores
Produtos afetados
Identificadores relacionados
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾