Flowise: FlowiseAI: Evaluator create+update mass-assignment allows cross-workspace evaluator takeover
Flowise
More for Flowise RSS feed for Flowise
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-46480
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 8, 2026
- Source last modified
- July 23, 2026
Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, evaluator create and update mass-assignment allows cross-workspace evaluator takeover. This issue has been patched in version 3.1.2.
Description quoted from the NVD record.
Who is affected
Flowise is a tool for building apps that use AI language models, with a drag and drop screen. This flaw affects all versions of Flowise before 3.1.2. The problem is in the part of Flowise used to create and edit evaluators. When someone creates or changes an evaluator, the product accepts settings it should not. Because of this, a person working in one workspace could take over evaluators that belong to a different workspace. This flaw is rated High.
What to do
- Find out who looks after your Flowise setup: the person who installed or runs it, or the IT provider or vendor who manages it for your organization.
- If you run Flowise yourself, update it to version
3.1.2or later, which fixes this flaw. - If an IT provider or vendor runs Flowise for you, send them this advisory and ask when the update to version
3.1.2will be done. - After the update, check that your Flowise installation is on version
3.1.2or later.
Analysis written from the source record as of July 23, 2026 and reviewed before publishing.