DeutschShown in its original language — a full translation is planned for a future version.
Flowise: Mehrere Schwachstellen
view advisory published 2026-03-05
Ein Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um sich erweiterte Berechtigungen zu verschaffen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.
01
describes (7)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-56276US | — | — | ||
Flowise before 3.1.2 contains a mass assignment vulnerability in the PUT /api/v1/user endpoint that allows authenticated users to directly modify the credential field without valid… | ||||
| CVE-2026-56267US | — | — | ||
Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoint that returns full user objects including PII to unauthenti… | ||||
| CVE-2026-30824US | critical9.8OT high | Exploit | ||
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router (/api/v1/nvidia-nim/*) is whitelisted in the… | ||||
| CVE-2026-30823US | —OT elevated | — | ||
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, there is an IDOR vulnerability, leading to account takeover and en… | ||||
| CVE-2026-30822US | — | — | ||
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, unauthenticated users can inject arbitrary values into internal da… | ||||
| CVE-2026-30821US | critical9.8 | — | ||
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the /api/v1/attachments/:chatflowId/:chatId endpoint is listed in… | ||||
| CVE-2026-30820US | high8.8OT elevated | — | ||
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, Flowise trusts any HTTP client that sets the header x-request-from… | ||||
02
references
External citations — patches, advisories, analysis.
- Flowise GitHub vom 2026-03-05external
- Flowise GitHub vom 2026-03-05external
- Flowise GitHub vom 2026-03-05external
- Flowise GitHub vom 2026-03-05external
- Flowise GitHub vom 2026-03-05external
- Flowise GitHub vom 2026-03-05external
- Flowise GitHub vom 2026-03-05external
- WID-SEC-W-2026-0626 - CSAF Versionself
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan