Flowise: FlowiseAI has Mass Assignment in Variable Update Endpoint that Allows Cross-Workspace Resource…
Flowise
More for Flowise RSS feed for Flowise
- Severity
- Critical, CVSS 9.6
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
- Record
- CVE-2026-42861
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 8, 2026
- Source last modified
- July 23, 2026
Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the variable update endpoint of FlowiseAI. The endpoint allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and updatedDate when updating a variable resource. Due to missing server-side validation and authorization checks, an attacker can manipulate the workspaceId field and reassign variables to arbitrary workspaces. This behavior may break tenant isolation in multi-workspace environments. This issue has been patched in version 3.1.2.
Description quoted from the NVD record.
Who is affected
Flowise is a drag-and-drop tool for building apps that use AI language models. This flaw affects versions before 3.1.2. It is in the part of the product that updates saved variables (stored values that your workflows can use). Anyone with a login could change details that only the system should control, including which workspace a variable belongs to, and move variables into any other workspace. In setups with several workspaces, this may break the separation that keeps each workspace's data apart from the others. This flaw is rated Critical.
What to do
- Whoever installed or runs Flowise for your organization should check which version you are using. Any version before
3.1.2has this flaw. - Update Flowise to version
3.1.2, which fixes this flaw. Plan the update as soon as possible rather than waiting for routine maintenance. - If an IT provider or vendor runs Flowise for your organization, send them this advisory and ask when the update to version
3.1.2will be done. - If your organization uses several workspaces in Flowise, tell the people who manage them about this flaw. Before the update, variables could have been moved from one workspace to another.
Analysis written from the source record as of July 23, 2026 and reviewed before publishing.