Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-69252

CVE-2026-69252HIGH

FlowiseAI Flowise — Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   N   H    7.2   .0054   43.7     —

AFFECTED
  Product  Versions   Fixed
  Flowise  < 3.1.3 –  —

TIMELINE
  Aug 3   Reserved by GitHub_M
  Aug 4   Published (CNA: GitHub_M)
  Sep 14  EXPLOIT PUBLISHED — CVE-2026-69252 (FlowiseAI Flowise). Public exploit reference added.

CWE-862 · CNA: GitHub_M · CVSS v4.0 · 4 references · NVD status: Analyzed

Description

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authenticated API key with unrelated permissions could call GET /api/v1/files to list files under the organization storage root and DELETE /api/v1/files?path=... to delete files belonging to other workspaces in the same organization because getAllFiles and deleteFile used activeOrganizationId and a user-controlled path without restricting access by permissions or activeWorkspaceId. This issue is fixed in version 3.1.3.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
August 3, 2026	Reserved	Reserved by GitHub_M
August 4, 2026	Published	Published (CNA: GitHub_M)
September 14, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-69252 (FlowiseAI Flowise). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
FlowiseAI	Flowise	—	< 3.1.3	—

Weaknesses

CWE-862

References (4)

https://github.com/FlowiseAI/Flowise/commit/bc22bf8baec95b6a3d6e1b3563b4f03491cd6fbb [Patch]
https://github.com/FlowiseAI/Flowise/pull/6435 [Issue Tracking, Patch]
https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3 [Patch, Release Notes]
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wp74-f5hh-5f3r [Exploit, Vendor Advisory]

Authoritative record: CVE-2026-69252 at cve.org

Vendors: flowiseai

Weaknesses: CWE-862

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-69252 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.