CVE-2026-56268

MEDIUM EPSS 19.9%
Published Jun 22, 20261w ago · Modified Jun 23, 20261w ago
5.3 CVSS 4.0
Medium
Find Similar
Published Jun 22, 2026 1w ago
Last Modified Jun 23, 2026 1w ago

Description

Flowise before 3.1.2 contains an information disclosure vulnerability in the /api/v1/chatflows/apikey/:apikey endpoint. When the keyonly query parameter is omitted (the default), the endpoint returns not only the chatflows bound to the supplied API key but also all chatflows across every workspace that have no API key assigned, because the underlying query lacks any workspace filter. An attacker with a valid API key for one workspace can therefore retrieve the full ChatFlow configuration (including flowData with system prompts and node configurations, chatbotConfig, apiConfig, and credential IDs) of unprotected chatflows belonging to other workspaces.

CVSS Details

Base Score
5.3
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
19.9% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-863 Incorrect Authorization Authorization

References 2

  • github.com https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-c2c9-mfw7-p8hw
  • vulncheck.com https://www.vulncheck.com/advisories/flowise-cross-workspace-information-disclosure-via-chatflows-apikey-endpoint

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.