{"id":"EUVD-2026-52850","enisaUuid":"0eeb2b55-8480-3040-97ab-768beae2a86c","description":"Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flowise injects $vars into the code execution sandbox without requiring variables:view, bypassing the permission-protected Variables API. Variables for the active workspace are fetched at packages/components/src/utils.ts and runtime variables are resolved from server environment variables, while the official variables route enforces variables:view. A user or API key that is denied variables:view can call /api/v1/node-custom-function and receive $vars pre-populated with all variables for the workspace, including Variable.name to Variable.value static variables and Variable.name to process.env[Variable.name] runtime variables. This can expose secrets such as database passwords, JWT secrets, SMTP passwords, and cloud keys, depending on the workspace Variables configuration. This issue is fixed in version 3.1.3.","datePublished":"Aug 4, 2026, 5:43:29 PM","dateUpdated":"Aug 4, 2026, 7:17:49 PM","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-8r8h-6vcc-xhrv\nhttps://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3\n","aliases":"CVE-2026-70471\nGHSA-8r8h-6vcc-xhrv\n","assigner":"GitHub_M","epss":0.41,"enisaIdProduct":[{"id":"040228d2-fc84-348f-bca3-66b10f10dd2e","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"\u003c 3.1.3"}],"enisaIdVendor":[{"id":"e1c0cacf-d707-395f-974b-cfd355364187","vendor":{"name":"FlowiseAI"}}],"enisaIdVulnerability":[{"id":"1b393afe-bfa1-31e5-abdb-a6d4dcda427f","vulnerability":{"id":"CVE-2026-70471","description":"Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flowise injects $vars into the code execution sandbox without requiring variables:view, bypassing the permission-protected Variables API. Variables for the active workspace are fetched at packages/components/src/utils.ts and runtime variables are resolved from server environment variables, while the official variables route enforces variables:view. A user or API key that is denied variables:view can call /api/v1/node-custom-function and receive $vars pre-populated with all variables for the workspace, including Variable.name to Variable.value static variables and Variable.name to process.env[Variable.name] runtime variables. This can expose secrets such as database passwords, JWT secrets, SMTP passwords, and cloud keys, depending on the workspace Variables configuration. This issue is fixed in version 3.1.3.","datePublished":"Aug 4, 2026, 5:43:29 PM","dateUpdated":"Aug 4, 2026, 7:17:49 PM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-8r8h-6vcc-xhrv\nhttps://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3\n","enisa_id":"EUVD-2026-52850\n","assigner":"GitHub_M","epss":0.41,"dataProcessed":"Nov 3, 2026, 7:13:01 AM","vulnerabilityProduct":[{"id":"7872812b-8e72-383f-a6f0-3ec1f68ce313","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"\u003c 3.1.3"}],"vulnerabilityVendor":[{"id":"c78e8a0a-6629-317c-847d-72fae836d2f0","vendor":{"name":"FlowiseAI"}}]}},{"id":"9f932f53-e7fc-3ddd-a701-8a6252dc03f6","vulnerability":{"id":"GHSA-8r8h-6vcc-xhrv","description":"Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure","datePublished":"Aug 4, 2026, 5:43:36 PM","dateUpdated":"Aug 4, 2026, 5:43:36 PM","baseScore":0.0,"references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-8r8h-6vcc-xhrv\nhttps://github.com/FlowiseAI/Flowise\nhttps://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3\n","enisa_id":"EUVD-2026-52850\n","aliases":"CVE-2026-70471\nGHSA-8r8h-6vcc-xhrv\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:49 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}