CVE-2026-71962 is a missing authorization vulnerability affecting Flowise versions 2.2.4 through 3.1.4. The vulnerability exists in the POST /api/v1/openai-assistants-file/download endpoint, which is incorrectly included in a global authentication whitelist. This misconfiguration allows unauthenticated attackers to bypass all session and API key verification. By providing valid chatflowId, chatId, and fileName parameters, attackers can access private files from any chatflow, including those belonging to other workspaces or organizations on the same instance.

An unauthenticated attacker can access private files from any chatflow on the affected Flowise instance, including files from other workspaces or organizations. This leads to unauthorized disclosure of potentially sensitive data. The vulnerability has a high severity with a CVSS 4.0 score of 8.7, indicating a network-exploitable flaw with no required privileges or user interaction and high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint by removing it from any global authentication whitelist or implementing proper authorization checks to ensure only authorized users can access files. Monitor for updates from FlowiseAI regarding an official fix.