CVE-2026-67621 describes a missing authorization vulnerability in Flowise through version 3.1.4. Authenticated workspace members with view-level permissions can exploit unprotected mutation endpoints related to document store operations. This allows them to perform unauthorized actions such as upserting and refreshing document stores, which impacts vector database contents and knowledge bases used by downstream chatflows. The vulnerability arises from insufficient access control on these mutation routes.

Attackers with only view-level permissions can abuse the vulnerability to manipulate document stores, refresh vector databases, and consume embedding API credits without proper authorization. This can lead to unauthorized modification of knowledge bases, potentially affecting the integrity and reliability of chatflows that depend on this data. The vulnerability does not require privilege escalation beyond authenticated view-level access but allows unauthorized operations within that scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published at this time. Users should monitor vendor communications for updates and consider restricting access to mutation endpoints until a fix is available.