EUVD-2026-275114

fkie_cve-2026-30822

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, unauthenticated users can inject arbitrary values into internal database fields when creating leads. This issue has been patched in version 3.0.13.

GHSA-mq4r-h2gh-qv7x — Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint

Affected: npm: flowise

## Summary

**A Mass Assignment vulnerability in the `/api/v1/leads` endpoint allows any unauthenticated user to control internal entity fields (`id`, `createdDate`, `chatId`) by including them in the request body.**

The endpoint uses `Object.assign()` to copy all properties from the request body to the Lead entity without any input validation or field filtering. This allows attackers to bypass auto-generated fields and inject arbitrary values.

| Field | Value | |-------|-------| | **Vulnerability Type** | Mass Assignment | | **CWE ID** | [CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes](https://cwe.mitre.org/data/definitions/915.html) | | **Authentication Required** | None | | **Affected Endpoint** | `POST /api/v1/leads` |

---

## Details

### Root Cause

The vulnerability exists in `/packages/server/src/services/leads/index.ts` at lines 27-28:

```typescript // File: /packages/server/src/services/leads/index.ts // Lines 23-38

const createLead = async (body: Partial<ILead>) => { try { const chatId = body.chatId ?? uuidv4()

const newLead = new Lead() Object.assign(newLead, body) // ← VULNERABILITY: All properties copied! Object.assign(newLead, { chatId })

const appServer = getRunningExpressApp() const lead = appServer.AppDataSource.getRepository(Lead).create(newLead) const dbResponse = await appServer.AppDataSource.getRepository(Lead).save(lead) return dbRespon…

WID-SEC-W-2026-0626 — Flowise: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um sich erweiterte Berechtigungen zu verschaffen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.

Most recent entries from all

EUVD-2026-275114

fkie_cve-2026-30822

GHSA-mq4r-h2gh-qv7x — Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint

WID-SEC-W-2026-0626 — Flowise: Mehrere Schwachstellen