Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-50173— Flow-Like: Azure invoke presign grants app content write SAS to ExecuteEvents-only users

Quick assessment

Affected
Rheosoph flow-like
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Flow-Like 是一个用于构建端到端用例的平台。在 1.0.4 版本之前， 接口会向任何拥有 （执行事件）权限的应用成员发放 Azure Blob Storage 的 SAS（Shared Access Signature）凭证，这些凭证对应用内容具有写入和删除权限，即使该成员不具备 （读取文件）和 （写入文件）权限。该路由在处理时，一旦通过 权限检查，便将文件权限视为可选条件。当调用者既没有读取文件的权限，也没有写入文件的权限时，系统仍会返回 类型。在 Azure 凭证提供者中， 仍然会为 生成带有 （即读取

CVSS 7.2 · High EPSS 0.50% · P41

Affected Version Matrix 1

VendorProduct Version RangeStatus
Rheosoph flow-like < 1.0.4 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-50173

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Flow-Like: Azure invoke presign grants app content write SAS to ExecuteEvents-only users
Source: CVE Program / CVE List V5
Vulnerability Description
Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, `GET /api/v1/apps/{app_id}/invoke/presign` grants Azure Blob Storage SAS credentials with write and delete access to app content to any app member that has `ExecuteEvents`, even when that member lacks `ReadFiles` and `WriteFiles`. The route treats file permissions as optional after the `ExecuteEvents` gate. When the caller has neither file permission, it selects `CredentialsAccess::InvokeNone`. In the Azure credential provider, `InvokeNone` still mints a `content_sas_token` for `apps/{app_id}` with `sp=rwdl`, plus user-content and log SAS tokens. The returned shared credential is enough for the low-privilege caller to directly write or delete blobs under the app content prefix. Version 1.0.4 patches the issue. Flow-Like Studio and the hosted Flow-Like Web App are not affected. These deployments use AWS-backed storage. Self-hosted deployments are only affected if they use Azure Blob Storage as the storage backend. In affected deployments, the issue only applies to authenticated app members who have workflow execution permissions but should not have app file write/delete permissions. Users of affected self-hosted Azure deployments should update to version 1.0.4 or the latest dev branch.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Rheosoph flow-like < 1.0.4 -

II. Public POCs for CVE-2026-50173

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-50173

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-50173 (1)

IV. Related Vulnerabilities

Same weakness: CWE-863

V. Comments for CVE-2026-50173

No comments yet

Leave a comment