CVE-2026-30820

HIGH

Flowise <3.0.13 - Privilege Escalation

Title source: llm
STIX 2.1

Description

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, Flowise trusts any HTTP client that sets the header x-request-from: internal, allowing an authenticated tenant session to bypass all /api/v1/** authorization checks. With only a browser cookie, a low-privilege tenant can invoke internal administration endpoints (API key management, credential stores, custom function execution, etc.), effectively escalating privilege. This issue has been patched in version 3.0.13.

Scores

CVSS v3 8.8
EPSS 0.0008
EPSS Percentile 24.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-863
Status published
Products (2)
flowiseai/flowise < 3.0.13
npm/flowise 0 - 3.0.13npm
Published Mar 07, 2026
Tracked Since Mar 07, 2026