A high-severity authorization bypass vulnerability in Flowise allows authenticated attackers with administrative privileges to potentially compromise data integrity and confidentiality.

The application is susceptible to an authorization bypass via user-controlled keys (CWE-639). This vulnerability requires the attacker to have administrative privileges to exploit the flaw successfully.

The ability for an authenticated administrator to bypass authorization checks poses a significant risk to the integrity and confidentiality of the large language model flows managed by the platform. With a CVSS score of 8.5, this high-severity flaw could lead to unauthorized data modification or access to sensitive model configurations, potentially impacting business operations and intellectual property.

Immediate Action: Update Flowise to version 3.1.3 or later to remediate this vulnerability.

Proactive Monitoring: Monitor administrative access logs for unusual patterns or attempts to access resources outside of assigned scopes.

Compensating Controls: Implement strict access control lists and review administrative user permissions to ensure the principle of least privilege is enforced until the patch is applied.

Public Exploit Available: No

Given the high CVSS score and the existence of a proof-of-concept, organizations should treat this vulnerability with high priority. Administrators must verify their current version and apply the 3.1.3 update immediately to eliminate the authorization bypass risk.