CVE-2026-70473

Medium

Elevated severity or exploit probability.

CVSS base

8.5 HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

EPSS — probability of exploitation (30 days)

0.3%

22.4th percentile

CISA KEV

Not listed

Weakness / dates

CWE-200

Published 2026-08-04 · modified 2026-09-11

CVSS breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Attack Vector	N	Network
Attack Complexity	L	Low
Privileges Required	L	Low
User Interaction	N	None
Scope	C	Changed
Confidentiality	H	High
Integrity	N	None
Availability	L	Low

Timeline

2026-08-04 — Published (NVD)
2026-09-11 — Last modified (NVD)

Description

Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or workspace. The response can exceed 100MB and includes sensitive configuration data, including Vector Store settings such as Qdrant Server URL and collection name. The observed behavior indicates missing or insufficient authorization checks, workspace/project/tenant isolation, and pagination or limits, exposing integration parameters and infrastructure details that may enable further targeted attacks. This issue is fixed in version 3.1.3.

Affected

flowiseai

References

Official: NVD · CVE.org