CVE-2026-100607

HighCVSS 7.7/10Last modified Sep 28, 2026

Description

Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing attackers to authenticate as any existing user by claiming their email at any configured SSO provider. Attackers can gain complete account access including chatflows, credentials, and API keys by authenticating through a different SSO provider or local password than the victim's original registration method.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
FlowiseAI	Flowise	<= 3.1.4

References

Timeline

Published: Sep 26, 2026
Last modified: Sep 28, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1006088.3Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. When the server runs in queue mode with the dashboard en CVE-2026-1006096.8Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up credentials by ID without filtering on the requesting user'CVE-2026-100619.8A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Affected is the function formWPS of the file /goform/formWPS. The manipulation of CVE-2026-1006107.5Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the CVE-2026-1006116.5Capgo (capgo.app backend, versions ≤ 12.261.0) improperly restricts which roles the apikey_manager organization role may bind to newly creat CVE-2026-1006127.2Capgo (capgo.app) through version 12.261.0 contains an incomplete access-control fix for the public.sso_providers table. Migration 202608261 CVE-2026-1006135.3capgo.app is an over-the-air (OTA) update platform for Capacitor apps. In all versions up to and including the current release (no patch ava CVE-2026-1006148.8Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image object keys from mut CVE-2026-1006158.8Cap-go capgo.app before 12.267.1 fails to validate target API key privilege during rotation, allowing an apikey_manager to rotate a higher-p CVE-2026-1006165.5capgo.app is an over-the-air update platform for Capacitor apps. In all versions prior to a fix, the row-level security UPDATE policy on the CVE-2026-1006178.8Cap-go capgo.app fails to validate that principals in channel_permission_overrides belong to the organization, allowing authenticated app/or CVE-2026-1006188.5Capgo (capgo.app) is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled `ico