Most recent entries from all

EUVD-2026-325913

2026-10-05T03:57:35.627096+00:00

EUVD-2026-325913

fkie_cve-2026-42861

2026-10-05T03:57:35.627132+00:00

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the variable update endpoint of FlowiseAI. The endpoint allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and updatedDate when updating a variable resource. Due to missing server-side validation and authorization checks, an attacker can manipulate the workspaceId field and reassign variables to arbitrary workspaces. This behavior may break tenant isolation in multi-workspace environments. This issue has been patched in version 3.1.2.

GHSA-6fw7-3q8r-m5vj — FlowiseAI has Mass Assignment in Variable Update Endpoint that Allows Cross-Workspace Resource Reassignment

2026-10-05T03:57:35.627183+00:00

Affected: npm: flowise

### Summary A Mass Assignment vulnerability exists in the variable update endpoint of FlowiseAI.

The endpoint allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and updatedDate when updating a variable resource.

Due to missing server-side validation and authorization checks, an attacker can manipulate the workspaceId field and reassign variables to arbitrary workspaces.

This behavior may break tenant isolation in multi-workspace environments.

### Details The endpoint responsible for updating variables:

**PUT /api/v1/variables/{variableId}**

accepts a JSON request body containing the variable definition.

However, the backend does not restrict which attributes can be modified by the client. As a result, user-controlled request bodies can include internal properties that should normally be controlled exclusively by the server.

Server-controlled fields that can be manipulated include:

- workspaceId - createdDate - updatedDate

These fields appear to be directly mapped to the database entity without strict input validation or authorization checks.

For example, the following request body was accepted by the server:

```json { "name": "aaa", "value": "bbbe", "type": "static", "createdDate": "2016-03-06T17:59:30.000Z", "updatedDate": "2016-03-06T18:00:17.000Z", "workspaceId": "11111111-2222-3333-4444-555555555555" } ```

The server accepted the attacker-controlled workspaceId and metadata fields and persisted the…

WID-SEC-W-2026-1554 — Flowise: Mehrere Schwachstellen ermöglichen Codeausführung

2026-10-05T03:57:35.627287+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um Code auszuführen, Objekte anderer Benutzer zu übernehmen, Informationen offenzulegen und weitere, nicht näher genannte Auswirkungen zu erzielen.