CVE-2026-67621

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.5

Description Authenticated workspace members can perform unauthorized document store operations due to missing authorization on mutation endpoints. Users with view-level permissions can send direct HTTP requests to the 'upsert' and 'refresh' document store routes. This allows them to trigger document ingestion, refresh vector database contents, consume embedding API credits, and modify knowledge bases utilized by downstream chatflows.

Recommendations Update Flowise to version 3.1.5 or later.