CVE-2026-70471: Flowise RBAC Bypass Leading to Workspace Variables Disclosure
CVE-2026-70471 is a missing authorization vulnerability (CWE-862) in Flowise before 3.1.3. The /api/v1/node-custom-function endpoint injects all workspace variables as $vars into the JavaScript execution sandbox without checking the variables:view permission, bypassing the correctly-protected /api/v1/variables route. The root cause is in utils.ts:932 (unconditional variable fetch) and utils.ts:1782 (unconditional sandbox injection). Any authenticated API key holder can call the endpoint with a payload returning $vars to read static and runtime variables, potentially exposing secrets such as database passwords, JWT secrets, cloud API keys, or SMTP credentials resolved from process.env. The fix in 3.1.3 gates $vars injection on the caller holding variables:view. Reported by Check Point Research.
Research notes
- Root causeutils.ts fetches all workspace variables unconditionally at line 932 and populates sandbox['$vars'] at line 1782 before handing control to user code, without calling the variables:view permission check. The dedicated /api/v1/variables route correctly enforces the permission at routes/variables/index.ts:11, confirming this is a forgotten authorization gate.
- Technical detailAny authenticated API key holder, regardless of RBAC role, can call /api/v1/node-custom-function with a JavaScript payload returning $vars to read all workspace variables. Static variables are exposed as stored values; runtime variables are resolved live from process.env, potentially exposing database passwords, JWT secrets, cloud API keys, or SMTP credentials.