CVE-2026-71962

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-71962
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71962.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-71962
Published
2026-08-10T18:26:18.577Z
Modified
2026-09-02T03:30:50.189602402Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Flowise 2.2.4 - 3.1.4 Missing Authorization via openai-assistants-file/download
Details

Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint that allows unauthenticated attackers to access private files by exploiting the endpoint's inclusion in the global authentication whitelist, which bypasses all session and API key verification. Attackers can supply valid chatflowId, chatId, and fileName identifiers to retrieve files from any chatflow on the instance, including private chatflows belonging to other workspaces or organizations.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71962.json",
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-862"
    ]
}
References

Affected packages

Git / github.com/flowiseai/flowise

Affected ranges

Type
GIT
Repo
https://github.com/flowiseai/flowise
Events
Introduced
ef96b57303c1ffe2c04340ebe97759fe20ecc649
Last affected
a65f81bb43ef66d3ce734bf0dff4223ae8041c95
Database specific
Show details 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "2.2.4"
        },
        {
            "last_affected": "3.1.4"
        }
    ]
}

Affected versions

flowise-components@2.*
flowise-components@2.2.4
flowise-components@2.2.5
flowise-components@2.2.6
flowise-components@2.2.7
flowise-components@2.2.7-patch.1
flowise-components@2.2.8
flowise-components@3.*
flowise-components@3.0.0
flowise-components@3.0.1
flowise-components@3.0.10
flowise-components@3.0.11
flowise-components@3.0.12
flowise-components@3.0.13
flowise-components@3.0.2
flowise-components@3.0.3
flowise-components@3.0.4
flowise-components@3.0.5
flowise-components@3.0.6
flowise-components@3.0.7
flowise-components@3.0.8
flowise-components@3.0.9
flowise-components@3.1.0
flowise-components@3.1.1
flowise-components@3.1.2
flowise-components@3.1.3
flowise-components@3.1.4
flowise-ui@2.*
flowise-ui@2.2.4
flowise-ui@2.2.5
flowise-ui@2.2.6
flowise-ui@2.2.7
flowise-ui@2.2.7-patch.1
flowise-ui@2.2.8
flowise-ui@3.*
flowise-ui@3.0.0
flowise-ui@3.0.1
flowise-ui@3.0.10
flowise-ui@3.0.11
flowise-ui@3.0.12
flowise-ui@3.0.13
flowise-ui@3.0.2
flowise-ui@3.0.3
flowise-ui@3.0.4
flowise-ui@3.0.5
flowise-ui@3.0.6
flowise-ui@3.0.7
flowise-ui@3.0.8
flowise-ui@3.0.9
flowise-ui@3.1.0
flowise-ui@3.1.1
flowise-ui@3.1.2
flowise-ui@3.1.3
flowise-ui@3.1.4
flowise@2.*
flowise@2.2.4
flowise@2.2.5
flowise@2.2.6
flowise@2.2.6-hotfix.1
flowise@2.2.7
flowise@2.2.7-patch.1
flowise@2.2.8
flowise@3.*
flowise@3.0.0
flowise@3.0.1
flowise@3.0.10
flowise@3.0.11
flowise@3.0.12
flowise@3.0.13
flowise@3.0.2
flowise@3.0.3
flowise@3.0.4
flowise@3.0.5
flowise@3.0.6
flowise@3.0.7
flowise@3.0.8
flowise@3.0.9
flowise@3.1.0
flowise@3.1.1
flowise@3.1.2
flowise@3.1.3
flowise@3.1.4
Other
pre-langchain-v1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71962.json"