Flowise: FlowiseAI: Evaluation create+update mass-assignment allows cross-workspace evaluation takeover
Flowise
More for Flowise RSS feed for Flowise
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-46479
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 8, 2026
- Source last modified
- July 23, 2026
Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, evaluation create and update mass-assignment allows cross-workspace evaluation takeover. This issue has been patched in version 3.1.2.
Description quoted from the NVD record.
Who is affected
Flowise is a drag-and-drop tool for building apps that use AI language models. This flaw affects all versions before 3.1.2. The problem is in the part of the product that creates and updates evaluations. When an evaluation is created or changed, Flowise accepts more information than it should, which could let someone take over evaluations that belong to a different workspace. Workspaces are the separate areas Flowise uses to keep different teams' or projects' work apart. This flaw is rated High.
What to do
- If someone in your organization installed and runs Flowise, that person should check which version is in use.
- If it is older than
3.1.2, update Flowise to version3.1.2or later, which fixes this flaw. - If an IT provider or vendor runs Flowise for your organization, send them this advisory and ask when the update to
3.1.2will be done. - If you are not sure whether your organization uses Flowise, ask the person or provider who looks after your computers and online tools.
Analysis written from the source record as of July 23, 2026 and reviewed before publishing.