CVE-2026-100610

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.5

Description Insufficient route-level permission checks and a lack of workspace or ownership validation in the backing service allow authenticated low-privilege users or those with a valid API key to access or delete document-store upsert history from other users and workspaces. This occurs when the target chatflowId (publicly exposed in share links) or row IDs are known. The issue involves the endpoints "GET /api/v1/upsert-history/:id" and "PATCH /api/v1/upsert-history", specifically within the getAllUpsertHistory() and patchDeleteUpsertHistory() functions. The getAllUpsertHistory() function returns rows based on an attacker-supplied chatflowid, while patchDeleteUpsertHistory() deletes rows using an attacker-supplied array of record UUIDs. Exposed data in the flowData and result fields may include embedding, record-manager, and vector-store node configurations, including per-node paramValues.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the "GET /api/v1/upsert-history/:id" and "PATCH /api/v1/upsert-history" endpoints.