Flowise vulnerabilities

Flowise prior to version 3.1.2 does not strip the encryptedData field from API responses when fetching credentials with a credentialName filter. Without the filter the field is omitted, but with the filter it is not, leading to leakage of encrypted data.

Flowise prior to version 3.1.2 has a mass assignment vulnerability in the chatflow update endpoint. It allows an authenticated user to modify server-controlled properties such as deployed, isPublic, workspaceId, and reassign the resource to another workspace.

A mass assignment vulnerability in the tool update endpoint of Flowise allows authenticated users to modify server-controlled properties such as workspaceId, breaking tenant isolation in multi-workspace environments.

A vulnerability was detected in FlowiseAI Flowise up to 3.0.12. This affects the function verify of the file packages/server/src/enterprise/services/account.service.ts of the component Endpoint. Performing a manipulation results in information disclosure. Remote exploitation of the attack is possible. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit is now public and may be used. Upgrading the affected component is recommended.

FlowiseAI Flowise up to version 3.0.12 contains a vulnerability in the User Controller Handler component where manipulation of the userId/organizationId/workspaceId/email arguments causes authorization bypass. The attack may be initiated remotely.

A security flaw has been discovered in FlowiseAI Flowise up to 3.0.12. Affected is the function Login of the file packages/server/src/enterprise/services/account.service.ts of the component API Response Handler. The manipulation results in information disclosure. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. You should upgrade the affected component.

Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log.

Flowise <= 2.2.3 is vulnerable to SQL Injection via tableName parameter at Postgres_VectorStores.