Flowise versions prior to 3.1.3 are vulnerable to an authorization bypass that exposes sensitive information to authenticated users, posing a significant risk to data confidentiality.

This vulnerability involves missing authorization controls and the exposure of sensitive information through data queries. It requires the attacker to have low-level authenticated access to the system to exploit the flaw.

The ability for an authenticated user to bypass authorization checks and access sensitive LLM flow data can lead to the compromise of proprietary workflows, API keys, or private configuration data. With a CVSS score of 8.3, this high-severity vulnerability represents a substantial risk to organizational data security, potentially leading to unauthorized data exfiltration and loss of integrity in customized AI deployments.

Immediate Action: Update Flowise to version 3.1.3 or later to apply the necessary authorization patches.

Proactive Monitoring: Review application access logs for unusual patterns of data retrieval or unexpected API requests originating from standard user accounts.

Compensating Controls: Implement strict network access controls and ensure that the Flowise instance is not exposed to the public internet without an identity-aware proxy or VPN.

Public Exploit Available: Unknown

The severity of this vulnerability, combined with the presence of proof-of-concept material, necessitates immediate action. Administrators must prioritize updating to version 3.1.3 to remediate the authorization bypass and prevent unauthorized access to sensitive LLM data.