CVE-2024-36421 impacts Flowise, a drag-and-drop interface for building custom large language model flows. This vulnerability stems from a CORS misconfiguration, allowing arbitrary origins to connect to the website and potentially steal user information. The Access-Control-Allow-Origin header is set to allow all origins in version 1.4.3. While the CVSS score is 7.5, the SOCRadar Vulnerability Risk Score (SVRS) is 30. This vulnerability can be chained with a path injection to enable unauthorized file access from the Flowise server. The unrestricted CORS policy, even in default unauthenticated configurations, can lead to significant data breaches. Given the potential for data theft and unauthorized access, this vulnerability poses a substantial risk to Flowise users. Note that as of the publication date, no known patches are available.