Log in / Sign up

Vulnerability details

CVE-2026-42863

FlowiseAI Flowise

Flowise: Mass Assignment in Chatflow Update Endpoint Allows Cross-Workspace AgentFlow Reassignment

CVSS 4.0
7.6High

Official description

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the chatflow update endpoint of FlowiseAI. The endpoint allows clients to modify server-controlled properties such as deployed, isPublic, workspaceId, createdDate, and updatedDate when updating a chatflow object. Due to missing server-side validation and authorization checks, an authenticated user can manipulate internal attributes of a chatflow and reassign it to another workspace. This allows cross-workspace resource reassignment and unauthorized modification of deployment and visibility settings. This issue has been patched in version 3.1.2.

CVSS scores

ScoreVersionSourceVector
7.6High 4.0 CVEProject cvelistV5 (CNA) (GitHub_M) CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Affected products

VendorProductVersionsSource
FlowiseAI Flowise < 3.1.2 CVEProject cvelistV5 (CNA)

References and advisories

2
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-06-08
Last updated
2026-06-08
State
Published
Assigner (CNA)
GitHub_M

Exploit prediction (EPSS)

0.31%
Probability of exploitation in 30 days
24.7%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
No
Exploitation
Proof of concept
Technical impact
Total

Weaknesses (CWE)

  • CWE-284
    Improper Access Control
  • CWE-639
    Authorization Bypass Through User-Controlled Key
  • CWE-915
    Improperly Controlled Modification of Dynamically-Determined Object Attributes