CVE-2026-70475: Flowise: Missing Authorization on Execution Update Endpoint

In packages/server/src/routes/executions/index.ts, GET / is wrapped in checkAnyPermission('executions:view') and DELETE /:id in checkAnyPermission('executions:delete'). The update route, router.put(['/', '/:id'], executionController.updateExecution), has no such middleware. The only requirement is a valid login or API key.

The reporter's example sends PUT /api/v1/executions/EXECUTION_ID with a low-privilege API key and a body of {"state": "FINISHED", "data": "MANIPULATED"}. The advisory says a low-privileged user can modify the state, data and metadata of any execution in their workspace. That could falsify workflow results or inject data into records that other people or systems rely on. For example, an execution that failed could be marked FINISHED, or its stored output replaced.

The vector rates integrity impact high and confidentiality and availability none. The report was a manual code audit of the main branch (flowise-components 3.1.0) and does not describe a tested exploit chain beyond the request above. The attacker also needs a valid execution ID in the workspace.

The flowise npm package, version 3.1.2 and earlier. Deployments with RBAC and API keys of differing privilege are the ones where the missing check matters. Check the version:

npm ls flowise

Upgrade flowise to 3.1.3.

npm install -g [email protected]

The fix is in pull request 6409. The advisory names no workaround. Until you upgrade, limit API key distribution, and block PUT requests to /api/v1/executions at your reverse proxy if nothing legitimate uses them.

Check access logs for PUT /api/v1/executions/ calls, especially from API keys that lack executions:view or other execution permissions. Compare execution records with their original runs: an execution whose state moved to FINISHED or whose data changed after completion, or whose updatedDate does not match the run time, may have been tampered with. List API keys and their permission sets and check for keys that were created recently.

Flowise Security Audit Report

Date: 2026-03-17 Researcher: Dimpal Jadhav ([email protected]) GitHub: https://github.com/Dimpyj1604 Target: FlowiseAI/Flowise (latest main branch) Version: [email protected]

FINDING 1: Missing Authorization on Execution Update Endpoint

Severity: HIGH (CVSS ~7.5) Type: CWE-862 (Missing Authorization) File: packages/server/src/routes/executions/index.ts:11

Description: The PUT /api/v1/executions/:id endpoint lacks the checkAnyPermission() middleware that protects all other execution endpoints (GET, DELETE). Any authenticated user — regardless of their assigned permissions — can modify any execution record.

Evidence:

// Line 7 - GET has permission check
router.get('/', checkAnyPermission('executions:view'), executionController.getAllExecutions)

// Line 11 - PUT has NO permission check
router.put(['/', '/:id'], executionController.updateExecution)  // <-- MISSING checkAnyPermission

// Line 14 - DELETE has permission checkadvisory_1_execution_auth_bypass
router.delete('/:id', checkAnyPermission('executions:delete'), executionController.deleteExecutions)

Impact: Privilege escalation. A low-privileged user with any valid API key can modify execution state, data, and metadata of any execution in their workspace. Could be used to manipulate workflow execution results or inject data.

Reproduction:

curl -X PUT https://TARGET/api/v1/executions/EXECUTION_ID \
  -H "Authorization: Bearer LOW_PRIV_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"state": "FINISHED", "data": "MANIPULATED"}'