PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-67621 FlowiseAI CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-06T22:18:22.717Z and has not been modified since then. CVE-2026-67621 is a missing authorization vulnerability in Flowise through version 3.1.4. The vulnerability allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers with view-level permissions can send direct HTTP requests to upsert and refresh document store routes, triggering document ingestion, refreshing vector database contents, consuming embedding API credits, and modifying knowledge bases used by downstream chatflows. Organizations using Flowise should verify their installations and ensure proper authorization settings are in place to prevent unauthorized document store operations. The CVE record indicates a missing authorization vulnerability in Flowise through version 3.1.4, allowing authenticated workspace members to perform unauthorized document store operations. Evidence is based on official CVE and NVD records, as well as references from vulncheck.com and a GitHub advisory. To address this vulnerability, users should verify Flowise installation and configuration to ensure proper authorization settings, restrict access to document store mutation endpoints, monitor for suspicious activity related to document store operations, and update Flowise to a version that addresses the vulnerability, if available.

Vendor
FlowiseAI
Product
Flowise
CVSS
HIGH 7.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-06
Original CVE updated
2026-09-15
Advisory published
2026-08-06
Advisory updated
2026-09-15

Who should care

Organizations using Flowise, particularly those with multiple workspace members or integrating Flowise with other applications, should be aware of this vulnerability and take steps to mitigate it.

Technical summary

CVE-2026-67621 is a missing authorization vulnerability in Flowise through version 3.1.4. The vulnerability allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers with view-level permissions can send direct HTTP requests to upsert and refresh document store routes, triggering document ingestion, refreshing vector database contents, consuming embedding API credits, and modifying knowledge bases used by downstream chatflows.

Defensive priority

Organizations using Flowise should verify their installations and ensure proper authorization settings are in place to prevent unauthorized document store operations.

Recommended defensive actions

  • Verify Flowise installation and configuration to ensure proper authorization settings.
  • Restrict access to document store mutation endpoints.
  • Monitor for suspicious activity related to document store operations.
  • Update Flowise to a version that addresses the vulnerability, if available.
  • Implement additional security measures, such as logging and auditing, to detect potential exploitation.

Evidence notes

The CVE-2026-67621 record indicates a missing authorization vulnerability in Flowise through version 3.1.4, allowing authenticated workspace members to perform unauthorized document store operations. Evidence is based on official CVE and NVD records, as well as references from vulncheck.com and a GitHub advisory.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-67621 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-67621

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-67621 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-67621

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.