An authorization bypass vulnerability in Flowise allows unauthenticated attackers to potentially modify sensitive application attributes.

This vulnerability involves an authorization bypass (CWE-639) and improper modification of dynamically determined object attributes (CWE-915). It allows an unauthenticated attacker to manipulate application logic.

Exploitation of this flaw can lead to unauthorized control over the large language model flows managed by the platform. With a CVSS score of 8.8, the lack of authentication requirements makes this a critical risk for any organization exposing the Flowise interface to the internet, as it could result in full application compromise.

Immediate Action: Upgrade Flowise to version 3.1.3 or higher to resolve the identified authorization bypass issues.

Proactive Monitoring: Monitor for unauthorized configuration changes or unexpected modifications to flow parameters within the application logs.

Compensating Controls: Ensure the Flowise dashboard is not exposed to the public internet and require VPN or mTLS authentication for all access.

Public Exploit Available: No (no confirmed public weaponized exploit exists in the provided data).

Given that this vulnerability allows for unauthenticated access and modification, it should be treated as a top-priority patch. Organizations should ensure they are running the latest version and verify that their deployment is not publicly accessible.