CVE-2026-70474: flowise before 3.1.3 (exclusive); +1 more affected products

CVE-2026-70474. CVSS 3.1 base score 8.1 (HIGH, NVD). EPSS 0.00477 (percentile 0.40213), scored 22-Oct-2026.

Affected technology

flowise · before 3.1.3 (exclusive)
flowiseai

Flowise · < 3.1.3
FlowiseAI

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Any authenticated user can initiate OAuth2 flows against credentials belonging to other workspaces, allows an unauthenticated attacker to forge OAuth2 callbacks to overwrite tokens in any credential, and allows an unauthenticated attacker to refresh tokens for any credential. Vendor/CNA’s CVSS 4.0 assessment (base score 7.6/10) rates confidentiality and integrity impact as high; availability impact as none.

Published 24-Oct-2026 01:43 UTC

CWE: CWE-863
CCR priority: 32.5 /100 (P4)
CVSS 3.1: 8.1 /10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · NVD
EPSS: 0.00477 · percentile 0.40213 · 2026-10-22
KEV: no

Provenance

NVD CVE API 2.0 · Source record · observed 2026-10-24 01:40:49.068977+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-70474.html