CVE-2026-71962
Flowise 2.2.4 - 3.1.4 Missing Authorization via openai-assistants-file/download
- State
- Published
- Severity
- 8.7 High
- Published
- Aug 10, 2026
- Updated
- Aug 14, 2026
- Reserved
- Aug 8, 2026
Description
Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint that allows unauthenticated attackers to access private files by exploiting the endpoint's inclusion in the global authentication whitelist, which bypasses all session and API key verification. Attackers can supply valid chatflowId, chatId, and fileName identifiers to retrieve files from any chatflow on the instance, including private chatflows belonging to other workspaces or organizations.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
FlowiseFlowiseAI |
|
References
- Researcher Disclosuretechnical-descriptionexploit
- Sunset Announcementvendor-advisory
- https://www.vulncheck.com/advisories/flowise-missing-authorization-via-openai-assistants-file-downloadthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.