CVE-2026-67621 FlowiseAI CVE debrief

Who should care

Organizations using Flowise, particularly those with multiple workspace members or integrating Flowise with other applications, should be aware of this vulnerability and take steps to mitigate it.

Technical summary

CVE-2026-67621 is a missing authorization vulnerability in Flowise through version 3.1.4. The vulnerability allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers with view-level permissions can send direct HTTP requests to upsert and refresh document store routes, triggering document ingestion, refreshing vector database contents, consuming embedding API credits, and modifying knowledge bases used by downstream chatflows.

Defensive priority

Organizations using Flowise should verify their installations and ensure proper authorization settings are in place to prevent unauthorized document store operations.

Recommended defensive actions

• Verify Flowise installation and configuration to ensure proper authorization settings.
• Restrict access to document store mutation endpoints.
• Monitor for suspicious activity related to document store operations.
• Update Flowise to a version that addresses the vulnerability, if available.
• Implement additional security measures, such as logging and auditing, to detect potential exploitation.

Evidence notes

The CVE-2026-67621 record indicates a missing authorization vulnerability in Flowise through version 3.1.4, allowing authenticated workspace members to perform unauthorized document store operations. Evidence is based on official CVE and NVD records, as well as references from vulncheck.com and a GitHub advisory.

Official resources