CVE-2026-71962

Name of the Vulnerable Software and Affected Versions Flowise versions 2.2.4 through 3.1.4

Description An authorization flaw exists in the 'POST /api/v1/openai-assistants-file/download' endpoint. Because this endpoint is included in the global authentication whitelist, it bypasses session and API key verification, allowing unauthenticated access. An attacker can retrieve private files from any chatflow on the instance, including those from other workspaces or organizations, by providing valid chatflowId, chatId, and fileName identifiers.

Recommendations Update Flowise to a version later than 3.1.4. As a temporary mitigation, restrict access to the 'POST /api/v1/openai-assistants-file/download' endpoint.