Flowise Broken Access Control on /api/v1/upsert-history Exposes Server-Wide Vector Store Configuration

Technical Analysis

The vulnerability stems from missing authorization and tenant-scoping logic on the upsert-history API in Flowise, an LLM/agent orchestration platform that manages vector store ingestion pipelines. Because the endpoint lacks RBAC checks, pagination, and workspace isolation, a single request returns unbounded, multi-tenant historical records (over 100MB observed) containing embedded configuration objects such as Qdrant server URLs, collection names, vector dimensions, and payload key mappings. An attacker with any valid session token can enumerate this data to map out other customers' vector database endpoints and collection names, which can then be used for reconnaissance or direct attacks (e.g., unauthorized queries, data exfiltration, or poisoning of the underlying vector store) if those backends lack their own independent authentication. This crosses tenant/agent boundaries within the same Flowise deployment, turning an internal orchestration API into a cross-tenant data leak vector.

Affected Systems

Flowise

Detection Signatures

• GET requests to /api/v1/upsert-history returning response sizes far exceeding expected per-user history size (>1MB, especially >100MB)
• Response payloads containing paramValues arrays with keys like qdrantServerUrl, qdrantCollection, pineconeApiKey, or similar vector store credentials not belonging to the requesting account
• Absence of workspace/tenant filter parameters in upsert-history API calls
• Repeated/automated calls to upsert-history from a single session enumerating large historical datasets

Remediation Steps

1. 1

   Upgrade Flowise

   Update to a patched Flowise version beyond 3.1.2 that includes fixes for GHSA-fr6g-7cq8-fg82 / CVE-2026-70473.

2. 2

   Enforce tenant/workspace scoping

   Modify the upsert-history endpoint (and similar history/log APIs) to filter results strictly by the authenticated user's workspace/tenant ID at the database query level, not just in the UI.

3. 3

   Add RBAC checks

   Require role-based authorization checks on all history and configuration retrieval endpoints to prevent cross-tenant access.

4. 4

   Implement pagination and response limits

   Cap response sizes and add mandatory pagination to prevent bulk data disclosure even if scoping fails.

5. 5

   Rotate exposed credentials

   Rotate Qdrant/vector store URLs, API keys, and collection identifiers that may have been exposed through this endpoint for any affected deployments.

6. 6

   Audit access logs

   Review historical access logs to /api/v1/upsert-history for anomalous large-response requests indicating prior exploitation.