Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

Summary

The GET /api/v1/upsert-history endpoint returns the entire server-wide upsert history (response size >100MB) instead of being scoped to the requesting user/tenant/workspace. The response includes sensitive configuration data (e.g., Vector Store settings such as Qdrant Server URL and collection name), resulting in a High severity information disclosure that may enable further targeted attacks.

Details

• Affected endpoint: GET /api/v1/upsert-history
• Observed behavior: The API returns global upsert history for the whole server, indicating missing/insufficient:
  • Authorization checks (RBAC/user-based access control)
  • Data scoping (workspace/project/tenant isolation)
  • Pagination/limits (excessive data exposure and very large responses)
• Sensitive data exposure: The returned history contains integration parameters and infrastructure details. Example excerpt from the response:

  {
    "label": "Qdrant",
    "name": "qdrant",
    "category": "Vector Stores",
    "id": "qdrant_0",
    "paramValues": [
      {
        "label": "Qdrant Server URL",
        "name": "qdrantServerUrl",
        "type": "string",
        "value": "https://7f60f255-f7fd-4a1c-a734-fbcf904f9f85.europe-west3-0.gcp.cloud.qdrant.io"
      },
      {
        "label": "Qdrant Collection Name",
        "name": "qdrantCollection",
        "type": "string",
        "value": "fair-herring-azure"
      },
      {
        "label": "Vector Dimension",
        "name": "qdrantVectorDimension",
        "type": "number",
        "value": 1536
      },
      {
        "label": "Content Key",
        "name": "contentPayloadKey",
        "type": "string",
        "value": "content"
      },
      {
        "label": "Metadata Key",
        "name": "metadataPayloadKey",
        "type": "string",
        "value": "metadata"
      },
      {
        "label": "Similarity",
        "name": "qdrantSimilarity",
        "type": "options",
        "value": "Cosine"
      }
    ]
  }