Threats tagged 'ghsa-c52g-w44q-cg6m'

Flowise versions up to 3.1.4 have a missing authorization control on the BullMQ admin dashboard when running in queue mode with the dashboard enabled and not in cloud mode. Any authenticated user, regardless of privilege level, can access the full Bull-Board UI and view sensitive data across all tenants. This includes chat inputs, credentials, custom function source code, and organizational identifiers. Additionally, users can perform write actions such as retrying, removing, promoting, and cleaning jobs across tenants. No patch is currently available for this vulnerability.