https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T21:21:34.418329+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-275114 EUVD-2026-275114 2026-10-07T21:21:34.423137+00:00 EUVD-2026-275114 https://cve.radiocsirt.org/vuln/fkie_cve-2026-30822 fkie_cve-2026-30822 2026-10-07T21:21:34.423175+00:00

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, unauthenticated users can inject arbitrary values into internal database fields when creating leads. This issue has been patched in version 3.0.13.

 https://cve.radiocsirt.org/vuln/ghsa-mq4r-h2gh-qv7x GHSA-mq4r-h2gh-qv7x — Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint 2026-10-07T21:21:34.423210+00:00

Affected: npm: flowise

## Summary

**A Mass Assignment vulnerability in the `/api/v1/leads` endpoint allows any unauthenticated user to control internal entity fields (`id`, `createdDate`, `chatId`) by including them in the request body.**

The endpoint uses `Object.assign()` to copy all properties from the request body to the Lead entity without any input validation or field filtering. This allows attackers to bypass auto-generated fields and inject arbitrary values.

| Field | Value | |-------|-------| | **Vulnerability Type** | Mass Assignment | | **CWE ID** | [CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes](https://cwe.mitre.org/data/definitions/915.html) | | **Authentication Required** | None | | **Affected Endpoint** | `POST /api/v1/leads` |

---

## Details

### Root Cause

The vulnerability exists in `/packages/server/src/services/leads/index.ts` at lines 27-28:

```typescript // File: /packages/server/src/services/leads/index.ts // Lines 23-38

const createLead = async (body: Partial<ILead>) => { try { const chatId = body.chatId ?? uuidv4()

const newLead = new Lead() Object.assign(newLead, body) // ← VULNERABILITY: All properties copied! Object.assign(newLead, { chatId })

const appServer = getRunningExpressApp() const lead = appServer.AppDataSource.getRepository(Lead).create(newLead) const dbResponse = await appServer.AppDataSource.getRepository(Lead).save(lead) return dbRespon…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0626 WID-SEC-W-2026-0626 — Flowise: Mehrere Schwachstellen 2026-10-07T21:21:34.423319+00:00

Ein Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um sich erweiterte Berechtigungen zu verschaffen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.