QSearchQSearch

CVE-2026-46444

8.8 HIGH

Flowise is a drag & drop user interface to build a customized large language model flow

Published: 2026-06-08 · Last updated: 2026-06-11

Severity and scoring

CVSS
8.8 HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-862

Affected products

VendorProduct
flowiseaiflowise

Description

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, all CRUD endpoints for OpenAI Assistants Vector Store have no authentication middleware and the route path /api/v1/openai-assistants-vector-store is not in WHITELIST_URLS. However, it is also not protected by the main auth middleware when accessed via API key — the route requires API key auth (not whitelisted), but no permission checks exist on any operation. This issue has been patched in version 3.1.2.

Source: NVD

References

Related CVEs

Same vendor

  • CVE-2026-46480 — Flowise is a drag & drop user interface to build a customized large language model flow (8.8 HIGH)
  • CVE-2026-46443 — Flowise is a drag & drop user interface to build a customized large language model flow (6.5 MEDIUM)
  • CVE-2026-46442 — Flowise is a drag & drop user interface to build a customized large language model flow (9.9 CRITICAL)
  • CVE-2026-46441 — Flowise is a drag & drop user interface to build a customized large language model flow (9.6 CRITICAL)
  • CVE-2026-46440 — Flowise is a drag & drop user interface to build a customized large language model flow (9.1 CRITICAL)

Same CWE

  • CVE-2026-46645 — SQLAdmin is a flexible Admin interface for SQLAlchemy models (4.3 MEDIUM)
  • CVE-2026-53634 — Sharp is a content management framework built for Laravel as a package (4.3 MEDIUM)
  • CVE-2026-0272 — A privilege escalation vulnerability in Palo Alto Networks PAN-OS® software allows an authenticated administrator with access to the Comm...
  • CVE-2026-49822 — Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes (7.7 HIGH)
  • CVE-2026-49821 — Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes (7.7 HIGH)