PT-2026-41209 · Flowiseai+1 · Flowise

Published 2026-05-14 · Updated 2026-06-11 · CVE-2026-46444

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.2

Description All CRUD endpoints for the OpenAI Assistants Vector Store lack authentication middleware and permission checks. Specifically, the route path "/api/v1/openai-assistants-vector-store" is not included in WHITELIST URLS and is not protected by the main authentication middleware when accessed via API key. Because the checkAnyPermission() function is missing, any authenticated user, regardless of their assigned role, can perform operations such as creating, modifying, and deleting vector stores and files, as well as uploading files to vector stores.

Recommendations Update to version 3.1.2.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-46444

GHSA-HMG2-JJJX-JCP2

Affected Products

Flowise

References · 7

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-hmg2-jjjx-jcp2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46444 · Security Note
• https://osv.dev/vulnerability/GHSA-hmg2-jjjx-jcp2 · Vendor Advisory
• https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.1.2 · Note
• https://github.com/FlowiseAI/Flowise · Note
• https://t.me/cveNotify/167016 · Telegram Post
• https://twitter.com/KaitanSecurity/status/2064022145802416430 · Twitter Post