CVE-2026-100605: Flowiseai Flowise

High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days.

Flowise through 3.1.4 contains missing route-level RBAC checks on chat message endpoints that allow low-privileged API keys to read and delete chat history. Attackers with valid but low-privileged API keys can access GET and DELETE chat message routes without required flow permissions to read chat histories, prompts, model responses, and delete messages.

Affected products

• Flowiseai Flowise: up to and including 3.1.4

Published 2026-09-26. Last modified 2026-09-30.