CVE-2026-70475 FlowiseAI CVE debrief

Who should care

Flowise users and administrators should assess exposure and apply the patch in version 3.1.3 to prevent potential privilege escalation and manipulation of workflow execution results.

Why it matters

CVE-2026-70475 is a high-severity vulnerability in Flowise that allows authenticated users to escalate privileges and manipulate workflow execution results. Defenders should prioritize patching to version 3.1.3 and monitor for unauthorized modifications.

• Potential privilege escalation for authenticated users
• Manipulation of workflow execution results
• Unauthorized modification of execution state, data, and metadata
• Verification of affected versions and scope required

Technical summary

The PUT /api/v1/executions/:id endpoint in Flowise versions prior to 3.1.3 lacks the checkAnyPermission() middleware, allowing any authenticated user to modify execution state, data, and metadata of any execution in their workspace. This vulnerability enables privilege escalation and manipulation of workflow execution results. The issue is fixed in version 3.1.3, which includes the necessary permission checks to prevent unauthorized modifications. Users should review and apply the patch to prevent potential exploitation.

Defensive priority

High priority for Flowise users and administrators

Recommended defensive actions

• Review and apply the patch in version 3.1.3
• Restrict access to the PUT /api/v1/executions/:id endpoint
• Monitor execution state, data, and metadata for unauthorized modifications
• Verify affected versions and scope
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the scope of affected versions and potential impact require verification from official sources. The vulnerability is confirmed to exist in Flowise versions prior to 3.1.3, and the patch is available in version 3.1.3. Users should verify their deployments and apply the patch or necessary mitigations. Official sources, including the CVE Program and NIST NVD, provide additional context and guidance on affected versions and remediation steps.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.