CVE-2026-70473

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3

Description Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. The GET /api/v1/upsert-history endpoint returns the entire server-wide upsert history instead of restricting the data to the requesting user, tenant, or workspace. This occurs due to missing or insufficient authorization checks, lack of workspace, project, or tenant isolation, and a lack of pagination or limits. The resulting response can exceed 100MB and exposes sensitive configuration data and infrastructure details, such as Vector Store settings including the qdrantServerUrl and qdrantCollection variables. This information disclosure may enable further targeted attacks.

Recommendations Update to version 3.1.3. As a temporary workaround, restrict access to the GET /api/v1/upsert-history endpoint to minimize the risk of exploitation.