CVE-2026-50173— Azure Invoke Presign 漏洞允许仅执行事件用户获取应用内容写入 SAS
一分钟漏洞结论
影响对象
Rheosoph flow-like
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Flow-Like 是一个用于构建端到端用例的平台。在 1.0.4 版本之前， 接口会向任何拥有 （执行事件）权限的应用成员发放 Azure Blob Storage 的 SAS（Shared Access Signature）凭证，这些凭证对应用内容具有写入和删除权限，即使该成员不具备 （读取文件）和 （写入文件）权限。该路由在处理时，一旦通过 权限检查，便将文件权限视为可选条件。当调用者既没有读取文件的权限，也没有写入文件的权限时，系统仍会返回 类型。在 Azure 凭证提供者中， 仍然会为 生成带有 （即读取
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-50173 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Flow-Like: Azure invoke presign grants app content write SAS to ExecuteEvents-only users
来源: CVE Program / CVE List V5
Vulnerability Description
Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, `GET /api/v1/apps/{app_id}/invoke/presign` grants Azure Blob Storage SAS credentials with write and delete access to app content to any app member that has `ExecuteEvents`, even when that member lacks `ReadFiles` and `WriteFiles`. The route treats file permissions as optional after the `ExecuteEvents` gate. When the caller has neither file permission, it selects `CredentialsAccess::InvokeNone`. In the Azure credential provider, `InvokeNone` still mints a `content_sas_token` for `apps/{app_id}` with `sp=rwdl`, plus user-content and log SAS tokens. The returned shared credential is enough for the low-privilege caller to directly write or delete blobs under the app content prefix. Version 1.0.4 patches the issue. Flow-Like Studio and the hosted Flow-Like Web App are not affected. These deployments use AWS-backed storage. Self-hosted deployments are only affected if they use Azure Blob Storage as the storage backend. In affected deployments, the issue only applies to authenticated app members who have workflow execution permissions but should not have app file write/delete permissions. Users of affected self-hosted Azure deployments should update to version 1.0.4 or the latest dev branch.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
来源: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
来源: CVE Program / CVE List V5
受影响产品
二、漏洞 CVE-2026-50173 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-50173 的情报信息
请登录查看更多情报信息。
CVE-2026-50173 厂商安全公告 (1)
IV. Related Vulnerabilities
V. Comments for CVE-2026-50173
暂无评论