Vulnerability Details CVE-2026-30820
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, Flowise trusts any HTTP client that sets the header x-request-from: internal, allowing an authenticated tenant session to bypass all /api/v1/** authorization checks. With only a browser cookie, a low-privilege tenant can invoke internal administration endpoints (API key management, credential stores, custom function execution, etc.), effectively escalating privilege. This issue has been patched in version 3.0.13.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 22.1%
CVSS Severity
CVSS v3 Score 8.8
References
Products affected by CVE-2026-30820
-
cpe:2.3:a:flowiseai:flowise:-
-
cpe:2.3:a:flowiseai:flowise:1.0.0
-
cpe:2.3:a:flowiseai:flowise:1.0.1
-
cpe:2.3:a:flowiseai:flowise:1.1.0
-
cpe:2.3:a:flowiseai:flowise:1.1.1
-
cpe:2.3:a:flowiseai:flowise:1.2.1
-
cpe:2.3:a:flowiseai:flowise:1.2.10
-
cpe:2.3:a:flowiseai:flowise:1.2.11
-
cpe:2.3:a:flowiseai:flowise:1.2.12
-
cpe:2.3:a:flowiseai:flowise:1.2.13
-
cpe:2.3:a:flowiseai:flowise:1.2.14
-
cpe:2.3:a:flowiseai:flowise:1.2.15
-
cpe:2.3:a:flowiseai:flowise:1.2.16
-
cpe:2.3:a:flowiseai:flowise:1.2.2
-
cpe:2.3:a:flowiseai:flowise:1.2.3
-
cpe:2.3:a:flowiseai:flowise:1.2.4
-
cpe:2.3:a:flowiseai:flowise:1.2.5
-
cpe:2.3:a:flowiseai:flowise:1.2.6
-
cpe:2.3:a:flowiseai:flowise:1.2.7
-
cpe:2.3:a:flowiseai:flowise:1.2.8
-
cpe:2.3:a:flowiseai:flowise:1.2.9
-
cpe:2.3:a:flowiseai:flowise:1.3.0
-
cpe:2.3:a:flowiseai:flowise:1.3.1
-
cpe:2.3:a:flowiseai:flowise:1.3.2
-
cpe:2.3:a:flowiseai:flowise:1.3.3
-
cpe:2.3:a:flowiseai:flowise:1.3.4
-
cpe:2.3:a:flowiseai:flowise:1.3.5
-
cpe:2.3:a:flowiseai:flowise:1.3.6
-
cpe:2.3:a:flowiseai:flowise:1.3.7
-
cpe:2.3:a:flowiseai:flowise:1.3.8
-
cpe:2.3:a:flowiseai:flowise:1.3.9
-
cpe:2.3:a:flowiseai:flowise:1.4.0
-
cpe:2.3:a:flowiseai:flowise:1.4.1
-
cpe:2.3:a:flowiseai:flowise:1.4.10
-
cpe:2.3:a:flowiseai:flowise:1.4.11
-
cpe:2.3:a:flowiseai:flowise:1.4.12
-
cpe:2.3:a:flowiseai:flowise:1.4.2
-
cpe:2.3:a:flowiseai:flowise:1.4.3
-
cpe:2.3:a:flowiseai:flowise:1.4.4
-
cpe:2.3:a:flowiseai:flowise:1.4.5
-
cpe:2.3:a:flowiseai:flowise:1.4.6
-
cpe:2.3:a:flowiseai:flowise:1.4.7
-
cpe:2.3:a:flowiseai:flowise:1.4.8
-
cpe:2.3:a:flowiseai:flowise:1.4.9
-
cpe:2.3:a:flowiseai:flowise:1.5.0
-
cpe:2.3:a:flowiseai:flowise:1.5.1
-
cpe:2.3:a:flowiseai:flowise:1.6.0
-
cpe:2.3:a:flowiseai:flowise:1.6.1
-
cpe:2.3:a:flowiseai:flowise:1.6.2
-
cpe:2.3:a:flowiseai:flowise:1.6.3
-
cpe:2.3:a:flowiseai:flowise:1.6.4
-
cpe:2.3:a:flowiseai:flowise:1.6.5
-
cpe:2.3:a:flowiseai:flowise:1.6.6
-
cpe:2.3:a:flowiseai:flowise:1.7.0
-
cpe:2.3:a:flowiseai:flowise:1.7.1
-
cpe:2.3:a:flowiseai:flowise:1.7.2
-
cpe:2.3:a:flowiseai:flowise:1.8.0
-
cpe:2.3:a:flowiseai:flowise:1.8.1
-
cpe:2.3:a:flowiseai:flowise:1.8.2
-
cpe:2.3:a:flowiseai:flowise:1.8.3
-
cpe:2.3:a:flowiseai:flowise:1.8.4
-
cpe:2.3:a:flowiseai:flowise:2.0.0
-
cpe:2.3:a:flowiseai:flowise:2.0.1
-
cpe:2.3:a:flowiseai:flowise:2.0.2
-
cpe:2.3:a:flowiseai:flowise:2.0.3
-
cpe:2.3:a:flowiseai:flowise:2.0.4
-
cpe:2.3:a:flowiseai:flowise:2.0.5
-
cpe:2.3:a:flowiseai:flowise:2.0.6
-
cpe:2.3:a:flowiseai:flowise:2.0.7
-
cpe:2.3:a:flowiseai:flowise:2.1.0
-
cpe:2.3:a:flowiseai:flowise:2.1.1
-
cpe:2.3:a:flowiseai:flowise:2.1.2
-
cpe:2.3:a:flowiseai:flowise:2.1.3
-
cpe:2.3:a:flowiseai:flowise:2.1.4
-
cpe:2.3:a:flowiseai:flowise:2.1.5
-
cpe:2.3:a:flowiseai:flowise:2.2.0
-
cpe:2.3:a:flowiseai:flowise:2.2.1
-
cpe:2.3:a:flowiseai:flowise:2.2.2
-
cpe:2.3:a:flowiseai:flowise:2.2.3
-
cpe:2.3:a:flowiseai:flowise:2.2.4
-
cpe:2.3:a:flowiseai:flowise:2.2.5
-
cpe:2.3:a:flowiseai:flowise:2.2.6
-
cpe:2.3:a:flowiseai:flowise:2.2.7
-
cpe:2.3:a:flowiseai:flowise:2.2.8
-
cpe:2.3:a:flowiseai:flowise:3.0.0
-
cpe:2.3:a:flowiseai:flowise:3.0.1
-
cpe:2.3:a:flowiseai:flowise:3.0.2
-
cpe:2.3:a:flowiseai:flowise:3.0.3
-
cpe:2.3:a:flowiseai:flowise:3.0.4
-
cpe:2.3:a:flowiseai:flowise:3.0.5
-
cpe:2.3:a:flowiseai:flowise:3.0.6
-
cpe:2.3:a:flowiseai:flowise:3.0.7
-
cpe:2.3:a:flowiseai:flowise:3.0.8