Flowise: FlowiseAI: Dataset create+update mass-assignment allows cross-workspace dataset takeover
Flowise
More for Flowise RSS feed for Flowise
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-46477
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 8, 2026
- Source last modified
- July 23, 2026
Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, dataset create and update mass-assignment allows cross-workspace dataset takeover. This issue has been patched in version 3.1.2.
Description quoted from the NVD record.
Who is affected
Flowise is a drag-and-drop tool for building apps that use AI language models. This flaw affects all versions before 3.1.2. It lies in the part of the product that creates and updates datasets (collections of data stored in Flowise). That part does not properly limit what details can be changed, so someone could take over a dataset that belongs to a different workspace. This flaw is rated High.
What to do
- If someone in your organization installed and runs Flowise, that person should check which version is in use.
- If the version is older than
3.1.2, that person should update Flowise to version3.1.2or later, which fixes this flaw. - If an IT provider or vendor runs Flowise for your organization, send them this advisory and ask when the update to version
3.1.2will be done. - For more details about this flaw and the fixed release, see the vendor advisory linked on this page.
Analysis written from the source record as of July 23, 2026 and reviewed before publishing.