Most recent entries from all

EUVD-2026-325524

2026-10-05T06:59:11.058695+00:00

EUVD-2026-325524

fkie_cve-2026-42862

2026-10-05T06:59:11.058733+00:00

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the tool update endpoint of FlowiseAI. The endpoint allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and updatedDate when updating a tool resource. Due to missing server-side validation and authorization checks, an attacker can manipulate the workspaceId field and reassign tools to arbitrary workspaces. This breaks tenant isolation in multi-workspace environments. This issue has been patched in version 3.1.2.

GHSA-x5v6-pj28-cwwm — FlowiseAI has Mass Assignment in Tool Update Endpoint that Allows Cross-Workspace Resource Reassignment

2026-10-05T06:59:11.058770+00:00

Affected: npm: flowise

### Summary A Mass Assignment vulnerability exists in the tool update endpoint of FlowiseAI.

The endpoint allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and updatedDate when updating a tool resource.

Due to missing server-side validation and authorization checks, an attacker can manipulate the workspaceId field and reassign tools to arbitrary workspaces. This breaks tenant isolation in multi-workspace environments.

### Details The endpoint responsible for updating tools:

**PUT /api/v1/tools/{toolId}**

accepts a JSON request body containing tool metadata.

However, the server does not restrict which properties may be modified by the client. As a result, user-controlled request bodies can include additional fields that should normally be controlled only by the backend.

Server-controlled fields that can be manipulated include:

1. workspaceId 2. createdDate 3. updatedDate

The request body is directly merged into the underlying database entity without proper DTO validation or authorization checks.

### PoC Authenticate to the Flowise interface.

Capture the request used to update a tool:

```http PUT /api/v1/tools/ Content-Type: application/json

Modify the request body by injecting additional fields:

{ "name": "aaa", "description": "bbb", "color": "linear-gradient(rgb(109,215,45), rgb(136,170,134))", "schema": "[]", "func": "", "iconSrc": "test", "workspaceId": "11111111-2222-3333-4444-555555555…

WID-SEC-W-2026-1554 — Flowise: Mehrere Schwachstellen ermöglichen Codeausführung

2026-10-05T06:59:11.058822+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um Code auszuführen, Objekte anderer Benutzer zu übernehmen, Informationen offenzulegen und weitere, nicht näher genannte Auswirkungen zu erzielen.