CVE-2026-70473 affects Flowise, a drag-and-drop interface for building LLM flows. Before version 3.1.3, the GET /api/v1/upsert-history endpoint returns the entire upsert history across the server rather than limiting data to the requesting user's scope. This results in exposure of sensitive configuration details, including integration parameters and infrastructure information like Vector Store settings (Qdrant Server URL and collection name). The flaw is due to missing or insufficient authorization checks and lack of tenant or workspace isolation, as well as absence of pagination or response size limits. The vulnerability is addressed in Flowise version 3.1.3.

An attacker with access to the vulnerable endpoint can retrieve sensitive configuration data for the entire server, including integration parameters and infrastructure details. This exposure could facilitate further targeted attacks against the infrastructure or integrations. The large response size (over 100MB) may also impact service availability or performance during exploitation. There is no indication of privilege escalation or remote code execution from this vulnerability alone.

This vulnerability is fixed in Flowise version 3.1.3. Users should upgrade to version 3.1.3 or later to remediate the issue. No vendor advisory is provided to indicate alternative mitigations or temporary fixes. Until upgraded, restrict access to the /api/v1/upsert-history endpoint to trusted users only and monitor for unusual access patterns.