Flowise: Missing Authorization on Execution Update Endpoint

# Flowise Security Audit Report **Date**: 2026-03-17 **Researcher**: Dimpal Jadhav ([email protected]) **GitHub**: https://github.com/Dimpyj1604 **Target**: FlowiseAI/Flowise (latest main branch) **Version**: [email protected] ### FINDING 1: Missing Authorization on Execution Update Endpoint **Severity**: HIGH (CVSS ~7.5) **Type**: CWE-862 (Missing Authorization) **File**: `packages/server/src/routes/executions/index.ts:11` **Description**: The `PUT /api/v1/executions/:id` endpoint lacks the `checkAnyPermission()` middleware that protects all other execution endpoints (GET, DELETE). Any authenticated user — regardless of their assigned permissions — can modify any execution record. **Evidence**: ```typescript // Line 7 - GET has permission check router.get('/', checkAnyPermission('executions:view'), executionController.getAllExecutions) // Line 11 - PUT has NO permission check router.put(['/', '/:id'], executionController.updateExecution) // <-- MISSING checkAnyPermission // Line 14 - DELETE has permission checkadvisory_1_execution_auth_bypass router.delete('/:id', checkAnyPermission('executions:delete'), executionController.deleteExecutions) ``` **Impact**: Privilege escalation. A low-privileged user with any valid API key can modify execution state, data, and metadata of any execution in their workspace. Could be used to manipulate workflow execution results or inject data. **Reproduction**: ```bash curl -X PUT https://TARGET/api/v1/executions/EXECUTION_ID \ -H "Authorization: Bearer LOW_PRIV_API_KEY" \ -H "Content-Type: application/json" \ -d '{"state": "FINISHED", "data": "MANIPULATED"}' ```

Source published

4 Aug 2026 19:18:47 UTC

Source modified

4 Aug 2026 19:41:02 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Publisher rating · HIGH