CVE-2026-30820
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, Flowise trusts any HTTP client that sets the header x-request-from: internal, allowing an authenticated tenant session to bypass all /api/v1/** authorization checks. With only a browser cookie, a low-privilege tenant can invoke internal administration endpoints (API key management, credential stores, custom function execution, etc.), effectively escalating privilege. This issue has been patched in version 3.0.13.
Package Versions Affected
Automatically patch vulnerabilities without upgrading
CVSS Version



Related Resources
References
https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.13, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30820.json, https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wvhq-wp8g-c7vq, https://nvd.nist.gov/vuln/detail/CVE-2026-30820
