High severity8.8NVD Advisory· Published Mar 7, 2026· Updated Jun 17, 2026
CVE-2026-30820
CVE-2026-30820
Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, Flowise trusts any HTTP client that sets the header x-request-from: internal, allowing an authenticated tenant session to bypass all /api/v1/** authorization checks. With only a browser cookie, a low-privilege tenant can invoke internal administration endpoints (API key management, credential stores, custom function execution, etc.), effectively escalating privilege. This issue has been patched in version 3.0.13.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
flowisenpm | < 3.0.13 | 3.0.13 |
Affected products
3Patches
Vulnerability mechanics
References
4- github.com/FlowiseAI/Flowise/security/advisories/GHSA-wvhq-wp8g-c7vqnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-wvhq-wp8g-c7vqghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-30820ghsaADVISORY
- github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.13nvdProductRelease NotesWEB
News mentions
0No linked articles in our index yet.