CVE-2026-46444CWE-862

Flowise: Vector Store No Permission Checks

High · published June 8, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
45.5
In the wild
Unconfirmed
What it is

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, all CRUD endpoints for OpenAI Assistants Vector Store have no authentication middleware and the route path /api/v1/openai-assistants-vector-store is not in WHITELIST_URLS. However, it is also not protected by the main auth middleware when accessed via API key — the route requires API key auth (not whitelisted), but no permission checks exist on any operation. This issue has been patched in version 3.1.2.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00555 · 45.5th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-06-08T15:25Z
EPSS history
Timeline
  • 08 JUN 15:25Z
    Flowise: Vector Store No Permission Checks
    cvelistv5