CVE-2026-42861
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
In Flowise prior to version 3.1.2, a mass assignment vulnerability exists in the variable update endpoint. An authenticated attacker can modify server-controlled properties such as workspaceId, potentially breaking tenant isolation in multi-workspace environments.
Risk Assessment
The risk for the organization is the potential breach of isolation between workspaces, which could lead to unauthorized access to other tenants' data.
Recommendation
Update Flowise to version 3.1.2 or later, which contains the fix.
Original NVD description (English source)
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the variable update endpoint of FlowiseAI. The endpoint allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and updatedDate when updating a variable resource. Due to missing server-side validation and authorization checks, an attacker can manipulate the workspaceId field and reassign variables to arbitrary workspaces. This behavior may break tenant isolation in multi-workspace environments. This issue has been patched in version 3.1.2.