{"vulnerability": "CVE-2026-69262", "sightings": [{"uuid": "835180d6-b0c5-47a5-9d20-4e10b610934e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69262", "type": "seen", "source": "https://gist.github.com/alon710/3c340657379dfd929a73082180747c70", "content": "# CVE-2026-69262: CVE-2026-69262: Incorrect Authorization Flaw in Flowise Chatflow Deletion Endpoint\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69262\n\n## Summary\nCVE-2026-69262 is a high-severity incorrect authorization vulnerability (CWE-863) within the Flowise drag-and-drop LLM flow platform. Prior to version 3.1.3, Flowise did not enforce resource-type validation on its deletion endpoint. Although routing middleware ensured users held deletion privileges for either chatflows or agentflows, the service level lacked validation checks to verify whether the target resource matched the user's specific permissions. Consequently, an authenticated user with only agentflow deletion permissions could delete arbitrary chatflow configurations, leading to unauthorized state modification and service disruption.\n\n## TL;DR\nFlowise versions prior to 3.1.3 contain an incorrect authorization flaw allowing users with limited deletion permissions (e.g., agentflows only) to delete other flow types (e.g., chatflows) due to missing resource-type validation checks in the deletion service layer.\n\n## Technical Details\n\n- **CWE ID**: CWE-863\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 7.1\n- **EPSS Score**: None recorded\n- **Impact**: High Availability Loss\n- **Exploit Status**: No public exploits\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Flowise Developer Tooling platform\n- **Flowise**: < 3.1.3 (Fixed in: `3.1.3`)\n\n## Mitigation\n\n- Upgrade Flowise to version 3.1.3 or higher\n- Implement strict downstream database entity type checks inside controller logic\n- Audit multi-tenant workspace environments for unauthorized deletion attempts\n- Restrict user permission roles to trust boundaries until the upgrade is complete\n\n**Remediation Steps:**\n1. Identify active Flowise platform deployments and evaluate their package versions\n2. Execute npm install -g flowise@3.1.3 to apply the server updates\n3. Restart the Flowise server processes to ensure the updated logic is executed\n4. Review API and reverse proxy logs for anomalous DELETE requests returning status code 200\n\n## References\n\n- [CVE-2026-69262 Detail Record](https://www.cve.org/CVERecord?id=CVE-2026-69262)\n- [GitHub Security Advisory GHSA-p5w8-m249-4r4v](https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-p5w8-m249-4r4v)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69262) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T17:31:02.930545Z"}]}