A high-severity access control vulnerability in Flowise allows unauthenticated attackers to bypass authorization, potentially leading to unauthorized data manipulation.

The application fails to properly enforce access controls (CWE-284) and is subject to authorization bypass through user-controlled keys (CWE-639). This vulnerability is accessible by unauthenticated attackers.

With a CVSS score of 8.3, this vulnerability presents a significant risk to the security of the Flowise environment. Unauthenticated access allows attackers to bypass security boundaries, potentially leading to unauthorized modification of LLM flows and system data, which could result in service disruption or loss of control over model outputs.

Immediate Action: Update Flowise to version 3.1.3 or later to ensure all access control and authorization bypass vulnerabilities are addressed.

Proactive Monitoring: Review application access logs for anomalous requests or unauthorized attempts to access protected endpoints.

Compensating Controls: Utilize a Web Application Firewall to block suspicious traffic patterns directed at the application API until the update is deployed.

Public Exploit Available: No

The severity of this flaw, combined with the lack of required authentication, necessitates immediate action. Organizations must upgrade to Flowise version 3.1.3 or higher immediately to mitigate the risk of unauthorized access and data manipulation.