CVE-2026-50173

Name of the Vulnerable Software and Affected Versions Flow-Like versions prior to 1.0.4

Description In self-hosted deployments using Azure Blob Storage as the storage backend, authenticated app members with ExecuteEvents permissions can obtain unauthorized write and delete access to app content. The issue occurs at the GET /api/v1/apps/{app id}/invoke/presign endpoint, which treats file permissions as optional after the ExecuteEvents check. When a user lacks ReadFiles and WriteFiles permissions, the system selects CredentialsAccess::InvokeNone. However, the Azure credential provider still generates a content sas token for apps/{app id} with sp=rwdl (read, write, delete, list) permissions, along with user-content and log SAS tokens. This allows low-privilege users to directly modify or delete blobs under the app content prefix.

Recommendations Update to version 1.0.4 or the latest dev branch.