Flowise: FlowiseAI: CustomTemplate create+update mass-assignment allows cross-workspace template takeover
Flowise
More for Flowise RSS feed for Flowise
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-46476
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 8, 2026
- Source last modified
- July 23, 2026
Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, CustomTemplate create and update mass-assignment allows cross-workspace template takeover. This issue has been patched in version 3.1.2.
Description quoted from the NVD record.
Who is affected
This flaw affects Flowise, a drag-and-drop tool for building apps that use AI language models. It affects all versions before 3.1.2. The problem is in the custom templates feature. When someone creates or updates a custom template, Flowise accepts more information than it should. This lets that person take over templates that belong to a different workspace. If your organization uses separate workspaces to keep teams or projects apart, someone in one workspace could take control of another workspace's templates. This flaw is rated High.
What to do
- If someone in your organization installed or runs Flowise, ask that person to check which version is in use. Any version before
3.1.2has this flaw. - That person should update Flowise to version
3.1.2or later, which fixes this problem. No workaround is named for this flaw, so updating is the way to close it. - If an IT provider or vendor runs Flowise for your organization, send them this advisory and ask when the update to
3.1.2will be done.
Analysis written from the source record as of July 23, 2026 and reviewed before publishing.