CVE-2026-69252

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3

Description An issue exists where the '/api/v1/files' endpoint is protected only by a feature gate and fails to enforce permission checks on GET and DELETE requests. This allows an authenticated user with a low-privileged API key to list and delete files belonging to other workspaces within the same organization. The flaw occurs because the getAllFiles() and deleteFile() functions rely on the activeOrganizationId and a user-controlled path variable without verifying the activeWorkspaceId or specific user permissions. This results in a breach of workspace isolation, potentially leading to unauthorized data access and destructive tampering.

Recommendations Update Flowise to version 3.1.3.