CVE-2026-67621

HighCVSS 7.6/10Last modified Oct 24, 2026

Description

Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers holding only view-level permissions can send direct HTTP requests to the upsert and refresh document store routes to trigger document ingestion, refresh vector database contents, consume embedding API credits, and modify knowledge bases used by downstream chatflows.

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Aug 6, 2026
Last modified
Oct 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-676229.9Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticaCVE-2026-676238.8Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding aCVE-2026-676246.5Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-676258.5Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.CVE-2026-676266.5Uncontrolled resource consumption in SQL Server allows an authorized attacker to deny service over a network.CVE-2026-676284.9Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-676296.5Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-67636.5Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and ThunCVE-2026-676306.5Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-676319.8Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.CVE-2026-676336.5Out-of-bounds read in SQL Server allows an authorized attacker to deny service over a network.CVE-2026-676369.0Out-of-bounds read in SQL Server allows an unauthorized attacker to execute code over a network.
CVE-2026-67621: High severity, CVSS 7.6 | Vulnix