{"id":"EUVD-2026-52912","enisaUuid":"e0f6501c-6843-3af0-b1ab-461acabeb0fe","description":"Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint is included in WHITELIST_URLS and requires no authentication. The endpoint decrypts the stored credential, sends a refresh request to the configured OAuth provider with the client secret and refresh token, and returns the refreshed access_token in the response body. An attacker with a credential ID can use the token to access the victim\u0027s connected service and can also exhaust refresh-token quota. This issue is fixed in 3.1.3.","datePublished":"Aug 4, 2026, 7:37:22 PM","dateUpdated":"Aug 5, 2026, 7:05:33 PM","baseScore":9.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-qgvm-j2hm-6m38\n","aliases":"CVE-2026-70478\nGHSA-qgvm-j2hm-6m38\n","assigner":"GitHub_M","epss":0.62,"enisaIdProduct":[{"id":"ab1812dc-6d39-3ad3-bddb-0e1d8993f4fd","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"\u003c 3.1.2"}],"enisaIdVendor":[{"id":"c761e689-4232-362f-bc71-2dfe541a84d0","vendor":{"name":"FlowiseAI"}}],"enisaIdVulnerability":[{"id":"aafd6408-62f0-3c35-8f39-25769cfcd65c","vulnerability":{"id":"GHSA-qgvm-j2hm-6m38","description":"Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service","datePublished":"Aug 4, 2026, 7:37:36 PM","dateUpdated":"Aug 4, 2026, 7:37:36 PM","baseScore":0.0,"references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-qgvm-j2hm-6m38\nhttps://github.com/FlowiseAI/Flowise\n","enisa_id":"EUVD-2026-52912\n","aliases":"GHSA-qgvm-j2hm-6m38\nCVE-2026-70478\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:59:06 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"b15cb2ef-a02d-3a05-991a-e2745f01db41","vulnerability":{"id":"CVE-2026-70478","description":"Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint is included in WHITELIST_URLS and requires no authentication. The endpoint decrypts the stored credential, sends a refresh request to the configured OAuth provider with the client secret and refresh token, and returns the refreshed access_token in the response body. An attacker with a credential ID can use the token to access the victim\u0027s connected service and can also exhaust refresh-token quota. This issue is fixed in 3.1.3.","datePublished":"Aug 4, 2026, 7:37:22 PM","dateUpdated":"Aug 5, 2026, 7:05:33 PM","status":"PUBLISHED","baseScore":9.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-qgvm-j2hm-6m38\n","enisa_id":"EUVD-2026-52912\n","assigner":"GitHub_M","epss":0.62,"dataProcessed":"Oct 28, 2026, 7:12:48 AM","vulnerabilityProduct":[{"id":"deb2b039-ab84-37a3-b650-e6c605a03efe","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"\u003c 3.1.2"}],"vulnerabilityVendor":[{"id":"80b91468-0445-36b4-a172-a8cb0e8a60ac","vendor":{"name":"FlowiseAI"}}]}}],"enisaIdAdvisory":[]}