CVE-2026-67621: Flowise Document Store RBAC Bypass Vulnerability

CVE-2026-67621 - Flowise Document Store RBAC Bypass Vulnerability Overview There is a server-side authorization bypass vulnerability in the Document Store management routes of Flowise. The application implements Role-Based Access Control (RBAC) via middleware, but two mutation endpoints responsible for document ingestion and refresh are not registered with the RBAC middleware. Any authenticated workspace member can trigger document ingestion or refresh operations, despite lacking the permissions required to control these actions. Scope Affected Versions: Flowise 3.1.3 Affected Components: Document Store / Vector Store Management Affected Routes: - - Affected Source: Remediation Insert the existing RBAC middleware into the route registration to ensure permission checks are performed before controller logic is executed. Technical Details Flowise implements authorization by attaching permission middleware to route definitions. Most Document Store management operations are protected: However, upon reviewing the route table, it was discovered that two mutation endpoints completely bypass this model: These two routes call their respective middleware directly without first performing any RBAC verification. Consequently, authorization depends solely on whether the caller holds an authenticated session within the workspace. Attack Scenario Assumptions: Alice manages a workspace. Bob is a limited workspace member. Bob only has the permission. Bob cannot modify the document store through the Flowise interface because the UI correctly hides management actions. Instead, Bob issues: or using a valid authenticated session. Since the server never invokes the RBAC middleware, both requests proceed directly to the mutation handlers. Despite Bob lacking the necessary administrative permissions, the document store will still be updated or refreshed. Laboratory Reproduction Test Environment: Flowise 3.1.3 Default RBAC implementation Multi-user lab deployment Environment: Workspace Administrator Limited Workspace Member Configured Document Store Procedure: 1. Create a user without permissions. 2. Ensure the user can authenticate normally. 3. Send: Observation: The request reaches the upsert middleware. Document ingestion begins. 4. Send: Observation: The refresh operation is executed successfully. Control Verification: Impact Authenticated workspace members, even without Document Store management permissions, can trigger unauthorized ingestion and refresh operations. Depending on the deployment configuration, this may result in: Unauthorized document ingestion Unexpected vector database updates Re-indexing of existing knowledge bases Increased API usage and embedding costs Storage consumption Modification of knowledge used by downstream chat flows The vulnerability is limited to the current workspace. No cross-workspace authorization bypass was found. Patch Analysis The vulnerability is caused by missing middleware rather than an error in permission logic. The appropriate fix is to insert the existing RBAC middleware before executing the controller. References CVE-2026-67621 CWE-862 CVSS v3.1

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-67621: Flowise Document Store RBAC Bypass Vulnerability

More from this source