CVE-2026-30820CWE-863

Flowise Authorization Bypass via Spoofed x-request-from Header

High · published March 7, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
50.3
In the wild
Unconfirmed
What it is

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, Flowise trusts any HTTP client that sets the header x-request-from: internal, allowing an authenticated tenant session to bypass all /api/v1/** authorization checks. With only a browser cookie, a low-privilege tenant can invoke internal administration endpoints (API key management, credential stores, custom function execution, etc.), effectively escalating privilege. This issue has been patched in version 3.0.13.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00646 · 50.3th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-03-07T05:07Z
EPSS history
Timeline
  • 07 MAR 05:07Z
    Flowise Authorization Bypass via Spoofed x-request-from Header
    cvelistv5