Vulnerability details

CVE-2026-42861

FlowiseAI Flowise

Flowise: Mass Assignment in Variable Update Endpoint Allows Cross-Workspace Resource Reassignment

CVSS 4.0

7.6High

Official description

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the variable update endpoint of FlowiseAI. The endpoint allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and updatedDate when updating a variable resource. Due to missing server-side validation and authorization checks, an attacker can manipulate the workspaceId field and reassign variables to arbitrary workspaces. This behavior may break tenant isolation in multi-workspace environments. This issue has been patched in version 3.1.2.

CVSS scores

Score	Version	Source	Vector
7.6High	4.0	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N`

Affected products

Vendor	Product	Versions	Source
FlowiseAI	Flowise	< 3.1.2	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-6fw7-3q8r-m5vj x_refsource_CONFIRM
https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.1.2 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-06-08
Last updated: 2026-06-09
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.25%

Probability of exploitation in 30 days

17%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Proof of concept
Technical impact: Partial

Weaknesses (CWE)

CWE-284
Improper Access Control
CWE-639
Authorization Bypass Through User-Controlled Key
CWE-915
Improperly Controlled Modification of Dynamically-Determined Object Attributes