GHSA-2q4w-x8h2-2fvh

Flowise Authentication Bypass vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2024-8181

Packages

Ecosystem	Package	Affected	Fixed in
npm	flowise	<= 1.8.2	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

An Authentication Bypass vulnerability exists in Flowise version 1.8.2. This could allow a remote, unauthenticated attacker to access API endpoints as an administrator and allow them to access restricted functionality.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-8181 advisory
https://github.com/FlowiseAI/Flowise package
https://tenable.com/security/research/tra-2024-22-0 web
https://tenable.com/security/research/tra-2024-33 web