CVE-2026-67621

highCVSS 7.6covered by 1 sourcefirst seen 2026-08-06

Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers holding only view-level permissions can send direct HTTP requests to the upsert and refresh document store routes to trigger document ingestion, refresh vector database contents, consume embedding API credits, and modify knowledge bases used by downstream chatflows.

⚡ Watch CVE-2026-67621

Get an email if CVE-2026-67621 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

highCVE-2026-67621: Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated…nvd · 2026-08-06

External references

NVD record for CVE-2026-67621

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-67621 status](https://www.csirts.com/badge/CVE-2026-67621)](https://www.csirts.com/cve/CVE-2026-67621)