GHSA-FM2F-4339-4P2F高危已审查

Flowise: Missing Authorization on Execution Update Endpoint

OSV 1.4.0 · github-reviewed · 修改于 2026-08-05 03:18

发布时间

2026-08-05 03:18

GitHub 审查时间

2026-08-05 03:18

NVD 发布时间

—

源文件

advisories/github-reviewed/2026/08/GHSA-fm2f-4339-4p2f/GHSA-fm2f-4339-4p2f.json

公告说明

Flowise Security Audit Report

Date: 2026-03-17 Researcher: Dimpal Jadhav ([email protected]) GitHub: https://github.com/Dimpyj1604 Target: FlowiseAI/Flowise (latest main branch) Version: [email protected]

FINDING 1: Missing Authorization on Execution Update Endpoint

Severity: HIGH (CVSS ~7.5) Type: CWE-862 (Missing Authorization) File: packages/server/src/routes/executions/index.ts:11

Description: The PUT /api/v1/executions/:id endpoint lacks the checkAnyPermission() middleware that protects all other execution endpoints (GET, DELETE). Any authenticated user — regardless of their assigned permissions — can modify any execution record.

Evidence:

// Line 7 - GET has permission check
router.get('/', checkAnyPermission('executions:view'), executionController.getAllExecutions)

// Line 11 - PUT has NO permission check
router.put(['/', '/:id'], executionController.updateExecution)  // <-- MISSING checkAnyPermission

// Line 14 - DELETE has permission checkadvisory_1_execution_auth_bypass
router.delete('/:id', checkAnyPermission('executions:delete'), executionController.deleteExecutions)

Impact: Privilege escalation. A low-privileged user with any valid API key can modify execution state, data, and metadata of any execution in their workspace. Could be used to manipulate workflow execution results or inject data.

Reproduction:

curl -X PUT https://TARGET/api/v1/executions/EXECUTION_ID \
  -H "Authorization: Bearer LOW_PRIV_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"state": "FINISHED", "data": "MANIPULATED"}'

标识信息

别名 / CVE

CVE-2026-70475

CWE

CWE-862

软件生态

npm

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V4

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

原始 OSV JSON

{
  "id": "GHSA-fm2f-4339-4p2f",
  "aliases": [
    "CVE-2026-70475"
  ],
  "details": "# Flowise Security Audit Report\n**Date**: 2026-03-17\n**Researcher**: Dimpal Jadhav ([email protected])\n**GitHub**: https://github.com/Dimpyj1604\n**Target**: FlowiseAI/Flowise (latest main branch)\n**Version**: [email protected]\n\n### FINDING 1: Missing Authorization on Execution Update Endpoint\n**Severity**: HIGH (CVSS ~7.5)\n**Type**: CWE-862 (Missing Authorization)\n**File**: `packages/server/src/routes/executions/index.ts:11`\n\n**Description**: The `PUT /api/v1/executions/:id` endpoint lacks the `checkAnyPermission()` middleware that protects all other execution endpoints (GET, DELETE). Any authenticated user — regardless of their assigned permissions — can modify any execution record.\n\n**Evidence**:\n```typescript\n// Line 7 - GET has permission check\nrouter.get('/', checkAnyPermission('executions:view'), executionController.getAllExecutions)\n\n// Line 11 - PUT has NO permission check\nrouter.put(['/', '/:id'], executionController.updateExecution)  // <-- MISSING checkAnyPermission\n\n// Line 14 - DELETE has permission checkadvisory_1_execution_auth_bypass\nrouter.delete('/:id', checkAnyPermission('executions:delete'), executionController.deleteExecutions)\n```\n\n**Impact**: Privilege escalation. A low-privileged user with any valid API key can modify execution state, data, and metadata of any execution in their workspace. Could be used to manipulate workflow execution results or inject data.\n\n**Reproduction**:\n```bash\ncurl -X PUT https://TARGET/api/v1/executions/EXECUTION_ID \\\n  -H \"Authorization: Bearer LOW_PRIV_API_KEY\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"state\": \"FINISHED\", \"data\": \"MANIPULATED\"}'\n```",
  "summary": "Flowise: Missing Authorization on Execution Update Endpoint",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.3"
            }
          ]
        }
      ],
      "package": {
        "name": "flowise",
        "ecosystem": "npm"
      },
      "database_specific": {
        "last_known_affected_version_range": "<= 3.1.2"
      }
    }
  ],
  "modified": "2026-08-04T19:18:47Z",
  "severity": [
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
    }
  ],
  "published": "2026-08-04T19:18:47Z",
  "references": [
    {
      "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-fm2f-4339-4p2f",
      "type": "WEB"
    },
    {
      "url": "https://github.com/FlowiseAI/Flowise/pull/6409",
      "type": "WEB"
    },
    {
      "url": "https://github.com/FlowiseAI/Flowise/commit/96a9b23b5a103b362a0ee1368d04636755be1bed",
      "type": "WEB"
    },
    {
      "url": "https://github.com/FlowiseAI/Flowise",
      "type": "PACKAGE"
    },
    {
      "url": "https://github.com/FlowiseAI/Flowise/releases/tag/[email protected]",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2026-08-04T19:18:47Z"
  }
}