CVE-2026-50173: Flow-Like Auth Bypass Vulnerability

CVE-2026-50173 Overview

CVE-2026-50173 is a broken access control vulnerability [CWE-863] in Flow-Like, a platform for building end-to-end workflow use cases. The flaw affects the GET /api/v1/apps/{app_id}/invoke/presign endpoint, which issues Azure Blob Storage Shared Access Signature (SAS) credentials to app members. App members holding only the ExecuteEvents permission receive SAS tokens with read, write, delete, and list rights over app content, even when they lack ReadFiles and WriteFiles permissions. The issue affects self-hosted deployments backed by Azure Blob Storage prior to version 1.0.4.

Critical Impact
Low-privilege authenticated app members can directly write or delete blobs under the app content prefix, bypassing file permission checks entirely.

Affected Products

Flow-Like self-hosted deployments prior to version 1.0.4
Deployments using Azure Blob Storage as the storage backend
Not affected: Flow-Like Studio and the hosted Flow-Like Web App (AWS-backed storage)

Discovery Timeline

2026-08-19 - CVE-2026-50173 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-50173

Vulnerability Analysis

The vulnerability resides in the presign route that mints Azure Blob Storage SAS credentials for Flow-Like app members. The route enforces the ExecuteEvents permission as a gate, then treats file permissions as optional when selecting the credential scope. Callers without ReadFiles or WriteFiles fall into the CredentialsAccess::InvokeNone branch, which the developer likely intended as a null or restricted case.

Inside the Azure credential provider, InvokeNone does not return an empty or read-only credential. Instead, it mints a content_sas_token for the apps/{app_id} path with permissions sp=rwdl (read, write, delete, list), plus additional user-content and log SAS tokens. The returned shared credential exceeds the caller's authorization boundary.

Root Cause

The root cause is an authorization logic error where the credential provider's default branch grants broader rights than the caller possesses. The permission model in the API route and the permission model in the credential provider disagree on what InvokeNone means, producing a privilege escalation path from ExecuteEvents to full blob write and delete.

Attack Vector

An authenticated app member with only workflow execution permissions calls GET /api/v1/apps/{app_id}/invoke/presign. The server returns SAS URLs that the caller uses to write or delete blobs directly against Azure Blob Storage under the apps/{app_id} prefix. This bypasses the application layer and any auditing that only observes Flow-Like API traffic.

No verified public exploit code is available. See the GitHub Security Advisory for vendor technical details.

Detection Methods for CVE-2026-50173

Indicators of Compromise

Azure Blob Storage PutBlob or DeleteBlob operations under the apps/{app_id}/ prefix originating from IP addresses tied to non-privileged app members.
SAS token issuance events from Flow-Like where the requesting user holds ExecuteEvents but not WriteFiles.
Unexpected mutation or deletion of app content blobs outside normal workflow execution timelines.

Detection Strategies

Audit Flow-Like application logs for /api/v1/apps/{app_id}/invoke/presign calls and correlate the caller's permission set against the SAS scopes returned.
Enable Azure Storage diagnostic logging and alert on sp=rwdl SAS-authenticated blob writes or deletes on app content containers.
Compare the set of principals performing blob writes against the set of principals with WriteFiles in Flow-Like.

Monitoring Recommendations

Ingest Azure Storage Analytics and Flow-Like API logs into a centralized log platform and normalize on user identity.
Baseline expected SAS token lifetimes and permission strings, then alert on deviations.
Track blob delete operations under apps/{app_id} as a high-signal event for this class of abuse.

How to Mitigate CVE-2026-50173

Immediate Actions Required

Upgrade self-hosted Flow-Like deployments to version 1.0.4 or the latest dev branch.
Rotate any Azure storage account keys or SAS signing keys that may have been used to issue over-privileged tokens.
Review app membership and revoke ExecuteEvents from users who do not require workflow execution.

Patch Information

Flow-Like version 1.0.4 patches the issue by aligning the Azure credential provider with the caller's file permissions. Users of affected self-hosted Azure deployments should update to 1.0.4 or the latest dev branch. Refer to the GitHub Security Advisory GHSA-99w9-5gvv-4v78 for release notes.

Workarounds

Restrict the ExecuteEvents permission to trusted app members until the patch is applied.
Apply Azure Storage account network rules to limit blob access to known application subnets.
Configure Azure Storage lifecycle and immutability policies on the apps/ container to reduce the impact of unauthorized deletes.

bash

# Configuration example: upgrade Flow-Like to the patched version
git fetch --tags
git checkout v1.0.4
# Rebuild and redeploy per your environment's deployment procedure