CVE-2026-69258

CriticalCVSS 9.1/10Last modified Oct 24, 2026

Description

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the unauthenticated POST /api/v1/prediction/:id endpoint accepted an overrideConfig object and unconditionally spread it into internal flowConfig and flowData objects in packages/server/src/utils/buildChatflow.ts and packages/server/src/utils/index.ts without checking apiOverrideStatus. This allowed unauthenticated attackers to inject arbitrary properties into the flow execution context of any public chatflow, overwrite values such as chatId, sessionId, and chatHistory, and control values resolved through $flow.* template variables consumed by flow nodes. This issue is fixed in version 3.1.3.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-639 CWE-915

Affected software

No affected versions have been published.

Timeline

Published: Aug 4, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-692598.8Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the SQLite Record Manager node in p CVE-2026-692628.1Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, `DELETE /api/v1/chatflows/:id` auth CVE-2026-692639.8Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 bl CVE-2026-692649.8Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code temp CVE-2026-692657.8Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.CVE-2026-692668.8Integer overflow or wraparound in Windows DHCP Server allows an unauthorized attacker to execute code over a network.CVE-2026-692676.5Insufficient granularity of access control in Windows Connected User Experiences and Telemetry allows an authorized attacker to disclose inf CVE-2026-692688.8Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-692697.8Integer underflow (wrap or wraparound) in Microsoft Standard XPS allows an authorized attacker to elevate privileges locally.CVE-2026-692707.8Heap-based buffer overflow in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate privileges locally.CVE-2026-692718.0Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network.CVE-2026-692727.1Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network.