CVE-2026-69262

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3

Description An authorization bypass exists in the DELETE /api/v1/chatflows/:id endpoint. The system uses the checkAnyPermission('chatflows:delete,agentflows:delete') function, which allows access if the user possesses either permission. However, the subsequent deletion logic only verifies the id and workspaceId without validating the resource type. This allows a user with only agentflows:delete permissions to delete a CHATFLOW, and a user with only chatflows:delete permissions to delete an AGENTFLOW within the same workspace, bypassing the intended Role-Based Access Control (RBAC) separation.

Recommendations Update Flowise to version 3.1.3.