Flowise: FlowiseAI: Assistant create+update mass-assignment allows cross-workspace assistant takeover
Flowise
More for Flowise RSS feed for Flowise
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-46475
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 8, 2026
- Source last modified
- July 23, 2026
Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, assistant create and update mass-assignment allows cross-workspace assistant takeover. This issue has been patched in version 3.1.2.
Description quoted from the NVD record.
Who is affected
Flowise is a drag-and-drop tool for building apps that use AI language models. This flaw affects all versions before 3.1.2. It sits in the part of Flowise that creates and updates assistants, the AI helpers you set up inside the product. When an assistant is created or changed, Flowise accepts more details than it should. This can let someone take over an assistant that belongs to a different workspace. This flaw is rated High.
What to do
- The person who installed or runs Flowise for your organization should check which version is in use.
- If the version is earlier than
3.1.2, update Flowise to version3.1.2or later, which fixes this flaw. - If an IT provider or vendor runs Flowise for you, send them this advisory and ask when the update to
3.1.2will be done. - After the update, check that Flowise now reports version
3.1.2or later, so you know the fix is in place.
Analysis written from the source record as of July 23, 2026 and reviewed before publishing.