FlowiseAI Flowise 权限管理不当漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://cn-sec.com/archives/4564884.html
• https://www.secrss.com/articles/83832
• https://cloud.tencent.com/developer/article/2630542
• https://cve.imfht.com/detail/CVE-2026-41273
• https://www.sentinelone.com/vulnerability-database/cve-2025-58434/
• https://avd.aliyun.com/detail?id=AVD-2026-30823
• https://github.com/FlowiseAI/Flowise/security
• https://www.sentinelone.com/vulnerability-database/cve-2026-30820/

Related Vulnerabilities

• PoCflowise-chatflows-exposure: Flowise AI - Unauthenticated Chatflows API Exposure
• Flowise /api/v1/loginmethod 未授权访问漏洞（CVE-2026-56270）
• PoCCVE-2026-56270: Flowise <= 3.0.13 - Unauthenticated OAuth Configuration Disclosure
• PoCCVE-2025-71324: Flowise - Path Traversal
• PoCCVE-2026-69251: Flowise < 3.1.3 - Remote Code Execution
• Flowise /api/v1/chatflows 文件上传漏洞（CVE-2025-71334）
• PoCCVE-2025-71334: Flowise - Path Traversal
• PoCCVE-2026-46442: Flowise < 3.1.2 - node-custom-function Unauthorized RCE
• FlowiseAI Flowise /api/v1/node-custom-function 代码执行漏洞（CVE-2026-46442）
• PoCCVE-2024-36420: Flowise 1.4.3 - Arbitrary File Read
• Flowise 任意文件读取漏洞(CVE-2024-36420)
• PoCCVE-2026-30824: Flowise - NVIDIA NIM Endpoints Missing Authentication
• PoCCVE-2025-59528: Flowise - Remote Code Execution