CVE-2026-100605

Flowise through 3.1.4 contains missing route-level RBAC checks on chat message endpoints that allow low-privileged API keys to read and delete chat history. Attackers with valid but low-privileged API keys can access GET and DELETE chat message routes without required flow permissions to read chat histories, prompts, model responses, and delete messages.

  • Published Sep 26, 2026
  • CVSS 7.5 high
  • 0.2% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-100605 at the National Vulnerability Database