CVE-2026-70474: CWE-863: Incorrect Authorization in FlowiseAI Flowise
FlowiseAI Flowise versions prior to 3.1.3 contain an incorrect authorization vulnerability in their OAuth2 credential endpoints. The endpoints authorize, callback, and refresh query credentials by ID without filtering by workspace ID, and some handlers are accessible without authentication. This flaw allows authenticated users to initiate OAuth2 flows using credentials from other workspaces and unauthenticated attackers to forge OAuth2 callbacks or refresh tokens for any credential. The issue is resolved in version 3.1.3.
AI Analysis
Technical Summary
CVE-2026-70474 is an incorrect authorization vulnerability (CWE-863) in FlowiseAI Flowise before version 3.1.3. The OAuth2 credential endpoints (/api/v1/oauth2-credential/authorize/<credential_id>, /callback, and /refresh) query credentials solely by ID without verifying workspace ownership. The callback and refresh handlers are whitelisted from authentication, enabling unauthenticated attackers to forge OAuth2 callbacks to overwrite tokens and refresh tokens for any credential. Authenticated users can also misuse the authorize endpoint to initiate OAuth2 flows against credentials belonging to other workspaces. This vulnerability allows unauthorized access and manipulation of OAuth2 credentials across workspaces. The vulnerability is fixed in Flowise version 3.1.3.
Potential Impact
An attacker can gain unauthorized access to OAuth2 credentials belonging to other workspaces. Authenticated users can misuse credentials from other workspaces, while unauthenticated attackers can forge OAuth2 callbacks to overwrite tokens and refresh tokens for any credential. This compromises the confidentiality and integrity of OAuth2 tokens, potentially leading to unauthorized access to connected services or data.
Mitigation Recommendations
Upgrade Flowise to version 3.1.3 or later, where this authorization flaw is fixed. No other mitigation is indicated by the vendor advisory.
CVE-2026-70474: CWE-863: Incorrect Authorization in FlowiseAI Flowise
Description
FlowiseAI Flowise versions prior to 3.1.3 contain an incorrect authorization vulnerability in their OAuth2 credential endpoints. The endpoints authorize, callback, and refresh query credentials by ID without filtering by workspace ID, and some handlers are accessible without authentication. This flaw allows authenticated users to initiate OAuth2 flows using credentials from other workspaces and unauthenticated attackers to forge OAuth2 callbacks or refresh tokens for any credential. The issue is resolved in version 3.1.3.
CVSS v4.0
Score 7.6high
Affected software
FlowiseAI
Flowise
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-70474 is an incorrect authorization vulnerability (CWE-863) in FlowiseAI Flowise before version 3.1.3. The OAuth2 credential endpoints (/api/v1/oauth2-credential/authorize/<credential_id>, /callback, and /refresh) query credentials solely by ID without verifying workspace ownership. The callback and refresh handlers are whitelisted from authentication, enabling unauthenticated attackers to forge OAuth2 callbacks to overwrite tokens and refresh tokens for any credential. Authenticated users can also misuse the authorize endpoint to initiate OAuth2 flows against credentials belonging to other workspaces. This vulnerability allows unauthorized access and manipulation of OAuth2 credentials across workspaces. The vulnerability is fixed in Flowise version 3.1.3.
Potential Impact
An attacker can gain unauthorized access to OAuth2 credentials belonging to other workspaces. Authenticated users can misuse credentials from other workspaces, while unauthenticated attackers can forge OAuth2 callbacks to overwrite tokens and refresh tokens for any credential. This compromises the confidentiality and integrity of OAuth2 tokens, potentially leading to unauthorized access to connected services or data.
Mitigation Recommendations
Upgrade Flowise to version 3.1.3 or later, where this authorization flaw is fixed. No other mitigation is indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-04T15:24:41.339Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a723098bf8831d5393f8de9
Added to database: 08/04/2026, 18:34:00 UTC
Last enriched: 08/12/2026, 15:50:17 UTC
Last updated: 09/18/2026, 10:01:33 UTC
Views: 50
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.