Caycon

**Name of the Vulnerable Software and Affected Versions** Flowise versions prior to 3.1.5 **Description** Authenticated workspace members can perform unauthorized document store operations due to missing authorization on mutation endpoints. Users with view-level permissions can send direct HTTP requests to the 'upsert' and 'refresh' document store routes. This allows them to trigger document ingestion, refresh vector database contents, consume embedding API credits, and modify knowledge bases utilized by downstream chatflows. **Recommendations** Update Flowise to version 3.1.5 or later.

**Name of the Vulnerable Software and Affected Versions** Flowise versions prior to 3.1.5 **Description** An insecure direct object reference (IDOR) occurs in the OpenAI Assistants integration. This issue allows authenticated attackers to access credentials from other workspaces by providing an arbitrary credential UUID to Assistants endpoints, as the system fails to verify workspace ownership. By exploiting the missing workspace-scoped authorization check in the credential lookup logic, attackers can enumerate assistant metadata across workspaces, retrieve listings for files and vector stores, and upload files into victim workspaces. **Recommendations** Update to version 3.1.5 or later.

**Name of the Vulnerable Software and Affected Versions** Flowise versions prior to 3.1.5 **Description** An authentication bypass exists due to prefix-based whitelist matching in the authentication middleware located in `packages/server/src/utils/constants.ts`. Unauthenticated attackers can send a POST request to the 'oauth2-credential refresh' endpoint with a trailing credential identifier to bypass authentication and authorization checks. This allows unauthorized OAuth token rotation for credentials in any workspace, which may disrupt dependent OAuth integrations. **Recommendations** Update Flowise to version 3.1.5 or later.

**Name of the Vulnerable Software and Affected Versions** Wolf CMS versions prior to 0.8.3.2 **Description** An issue in the `FileManagerController` allows authenticated attackers with the `file manager mkfile` capability to achieve remote code execution. This is possible due to missing file extension validation in the `create file()` and `save()` functions, enabling the creation of arbitrary PHP files within the web-accessible `FILES DIR` directory. Execution is triggered by requesting the created file over HTTP. **Recommendations** Update Wolf CMS to version 0.8.3.2 or later. As a temporary mitigation, restrict the `file manager mkfile` capability to trusted users only.

**Name of the Vulnerable Software and Affected Versions** Wolf CMS versions prior to 0.8.3.2 **Description** An authorization bypass exists in the `BackupRestoreController` due to a PHP operator precedence flaw in the permission check expression. This allows authenticated users without administrative privileges to bypass access controls and perform restricted actions, including creating, downloading, and restoring backups. **Recommendations** Update Wolf CMS to version 0.8.3.2 or later.