https://vulnerability.circl.lu/sightings/feed 2026-08-05T15:07:10.694531+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/f41bc285-459c-4340-9a58-fd443e380546/export 2026-08-05T15:07:10.701587+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "f41bc285-459c-4340-9a58-fd443e380546", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-wch5-xp77-fxg4", "type": "seen", "source": "https://gist.github.com/alon710/1b2f0c6a49d8d6453f101ab57c6809f5", "content": "# CVE-2026-70474: CVE-2026-70474: Incorrect Authorization and Missing Authentication in Flowise OAuth2 Credential Endpoints\n\n> **CVSS Score:** 7.6\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70474\n\n## Summary\nA critical authorization flaw exists in Flowise, a popular drag-and-drop orchestrator for building customized Large Language Model flows. Prior to version 3.1.3, multiple OAuth2 credential endpoints do not filter database lookups by the requesting entity's workspace context. This omission, combined with the exclusion of several endpoints from the global authentication pipeline, permits unauthenticated remote actors to access, manipulate, or steal access tokens linked to external service integrations.\n\n## TL;DR\nUnauthenticated remote attackers can exfiltrate active third-party access tokens, inject rogue OAuth2 states, or access cross-workspace metadata due to missing workspace isolation and overly permissive API routing whitelists in Flowise < 3.1.3.\n\n## Technical Details\n\n- **CWE ID**: CWE-863 (Incorrect Authorization)\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 7.6 (High)\n- **Exploit Status**: PoC / Publicly Documented\n- **KEV Status**: Not Listed\n- **Impact**: Unauthenticated Token Theft & Injection\n\n## Affected Systems\n\n- Flowise (npm package 'flowise')\n\n## Mitigation\n\n- Upgrade Flowise to version 3.1.3 or later\n- Deploy Flowise behind a VPN or Zero-Trust Network Access (ZTNA) gateway\n- Configure WAF rules to block external access to '/api/v1/oauth2-credential/refresh/' and '/api/v1/oauth2-credential/callback' paths\n\n**Remediation Steps:**\n1. Verify the installed version of Flowise in package.json or system headers\n2. Execute 'npm install flowise@3.1.3' or update container images to 'flowiseai/flowise:3.1.3' or newer\n3. Rotate external OAuth2 client secrets and existing authorization tokens linked to Flowise database records\n\n## References\n\n- [GitHub Security Advisory](https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wch5-xp77-fxg4)\n- [Flowise 3.1.3 Release Tag](https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3)\n- [Official CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-70474)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70474) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T19:31:47.311319Z"} 2026-08-04T19:31:47.311319+00:00