Flowise: FlowiseAI: DatasetRow create+update mass-assignment allows cross-workspace row takeover
Flowise
More for Flowise RSS feed for Flowise
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-46478
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 8, 2026
- Source last modified
- July 23, 2026
Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, DatasetRow create and update mass-assignment allows cross-workspace row takeover. This issue has been patched in version 3.1.2.
Description quoted from the NVD record.
Who is affected
Flowise is a drag-and-drop tool for building apps that use AI language models. This flaw affects all versions before 3.1.2. The problem is in the datasets feature, in the part that adds and changes rows of data. When someone creates or updates a row, they can set details they should not be allowed to change. This lets them take over data rows that belong to a different workspace (a separate area of Flowise meant for another team or group). This flaw is rated High.
What to do
- Find out who installed and runs Flowise for your organization, whether that is someone on your staff or an IT provider or vendor.
- If someone on your staff runs it, ask them to check which version is installed. Any version before
3.1.2is affected. - That person should update Flowise to version
3.1.2or later, which fixes this flaw. - If an IT provider or vendor runs Flowise for you, send them this advisory and ask when the update to
3.1.2will be done.
Analysis written from the source record as of July 23, 2026 and reviewed before publishing.