{"action":"Upgrade flowise to 3.1.3 or later.","affected":[{"fixed":"3.1.3","introduced":"0"}],"component":"flowise","cve_ids":["CVE-2026-69262"],"ecosystem":"npm","epss":0.00524,"exploited":false,"fixed_versions":["3.1.3"],"ghsa_id":"GHSA-p5w8-m249-4r4v","id":"tcs_01M5KG2NFK4WNNA8BJ1TB4NXVS","modified_at":"2026-08-04T17:11:03.543517Z","published_at":"2026-08-04T16:50:32Z","references":["https://osv.dev/vulnerability/GHSA-p5w8-m249-4r4v","https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-p5w8-m249-4r4v","https://github.com/FlowiseAI/Flowise/pull/6445","https://github.com/FlowiseAI/Flowise/commit/2f528ceced74afaa95fc7a282965e7788796448b","https://github.com/FlowiseAI/Flowise","https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-p5w8-m249-4r4v","url":"https://osv.dev/vulnerability/GHSA-p5w8-m249-4r4v"},{"source":"nvd","source_id":"CVE-2026-69262","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69262"}],"summary":"Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow type"}