CVE-2026-67621 is a missing authorization vulnerability in Flowise (up to version 3.1.4) where authenticated users with view-level permissions can access unprotected mutation endpoints related to document store operations. This flaw enables them to perform unauthorized actions such as upserting and refreshing document stores, which affects the integrity and resource usage of the system. The vulnerability is classified under CWE-862 and has a CVSS 4.0 base score of 7.2, indicating high severity. No official patch or remediation level has been published as of the data provided.

Authenticated users with limited permissions can escalate their capabilities to modify document stores, refresh vector databases, and consume embedding API credits without proper authorization. This can lead to unauthorized modification of knowledge bases that downstream chatflows rely on, potentially impacting the accuracy and reliability of those chatflows and causing resource misuse.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected mutation endpoints where possible and monitor for unusual activity from users with view-level permissions. Avoid granting unnecessary workspace membership permissions to reduce risk.