High
Flowise through 3.1.4 Missing Authorization via upsert-history
Type: advisorySource: Official CVE List
Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspace or ownership validation. getAllUpsertH…
Products: FlowiseCVEs: CVE-2026-100610