CVE-2026-50173
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
Flow-Like before version 1.0.4 grants app members with ExecuteEvents permissions, but lacking ReadFiles and WriteFiles, SAS credentials to Azure Blob Storage with write and delete access to app content. Even when InvokeNone mode is selected, the SAS token still includes rwdl permissions for the app prefix.
Risk Assessment
A low-privilege user can directly write or delete blobs in app content, potentially leading to unauthorized data modification or deletion.
Recommendation
Update Flow-Like to version 1.0.4 or the latest dev branch, especially for self-hosted deployments using Azure Blob Storage.
Original NVD description (English source)
Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, `GET /api/v1/apps/{app_id}/invoke/presign` grants Azure Blob Storage SAS credentials with write and delete access to app content to any app member that has `ExecuteEvents`, even when that member lacks `ReadFiles` and `WriteFiles`. The route treats file permissions as optional after the `ExecuteEvents` gate. When the caller has neither file permission, it selects `CredentialsAccess::InvokeNone`. In the Azure credential provider, `InvokeNone` still mints a `content_sas_token` for `apps/{app_id}` with `sp=rwdl`, plus user-content and log SAS tokens. The returned shared credential is enough for the low-privilege caller to directly write or delete blobs under the app content prefix. Version 1.0.4 patches the issue. Flow-Like Studio and the hosted Flow-Like Web App are not affected. These deployments use AWS-backed storage. Self-hosted deployments are only affected if they use Azure Blob Storage as the storage backend. In affected deployments, the issue only applies to authenticated app members who have workflow execution permissions but should not have app file write/delete permissions. Users of affected self-hosted Azure deployments should update to version 1.0.4 or the latest dev branch.