highCVE-2026-70475Aug 4, 2026

CVE-2026-70475: Flowise Missing Authorization on Execution Update Endpoint

Rohit Hatagale
AI Security Researcher, SecureLayer7

Any authenticated Flowise user, regardless of their role, could overwrite the state and data of any workflow execution because the PUT endpoint had no permission check.

Packageflowise
Ecosystemnpm
Affected<= 3.1.2
Fixed in3.1.3
CVE-2026-70475: Flowise Missing Authorization on Execution Update Endpoint

The problem

Flowise's execution router applies checkAnyPermission() middleware to GET and DELETE routes, but the PUT /api/v1/executions/:id route was left completely unguarded in versions up to and including 3.1.2.

Any user holding a valid API key, even one with the lowest possible permissions, can send a PUT request to modify execution records belonging to other users in the same workspace. The impact includes privilege escalation, result tampering, and injection of arbitrary data into workflow audit logs.

Proof of concept

A working proof-of-concept for CVE-2026-70475 in flowise, with the exact payload below.

bash
curl -X PUT https://TARGET/api/v1/executions/EXECUTION_ID \
  -H "Authorization: Bearer LOW_PRIV_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"state": "FINISHED", "data": "MANIPULATED"}'

The root cause is a simple omission in packages/server/src/routes/executions/index.ts. The GET route at line 7 passes through checkAnyPermission('executions:view') and the DELETE route at line 14 passes through checkAnyPermission('executions:delete'), but the PUT route at line 11 called executionController.updateExecution directly with no middleware in between.

The patch (PR #6409, commit 96a9b23) adds checkAnyPermission('executions:update') to the PUT route, making it consistent with every other verb on the same router. The CWE-862 (Missing Authorization) classification is precise: authorization logic existed in the application, it was just never wired to this specific route.

The fix

Upgrade flowise to version 3.1.3 or later. The patch adds the missing checkAnyPermission('executions:update') middleware to the PUT /api/v1/executions/:id route. No configuration changes are required after upgrading.

Reported by Dimpal Jadhav.

References: [1][2][3][4][5]

Related research