EUVD-2026-25284
GHSA-48m6-ch88-55mj
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network endpoint (PR:N/AV:N) but hijacking a tenant requires knowing a valid existing org UUID (AC:H); high confidentiality/integrity from cross-tenant takeover, no clear availability impact (A:N).
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
6DescriptionGitHub Advisory
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, an improper mass assignment (JSON injection) vulnerability in the account registration endpoint of Flowise Cloud allows unauthenticated attackers to inject server-managed fields and nested objects during account creation. This enables client-controlled manipulation of ownership metadata, timestamps, organization association, and role mappings, breaking trust boundaries in a multi-tenant environment. This vulnerability is fixed in 3.1.0.
AnalysisAI
Improper mass assignment in the account registration endpoint of Flowise (Flowise Cloud, versions prior to 3.1.0) lets unauthenticated attackers smuggle server-managed fields and nested objects into the POST /api/v1/account/register payload, forging ownership metadata, timestamps, organization association, and role mappings. In a multi-tenant SaaS deployment this breaks tenant trust boundaries, potentially letting an attacker attach a freshly-registered account to an existing organization with an elevated role. Publicly available exploit code exists (a working PoC is published in the GitHub Security Advisory), but the issue is not in CISA KEV and EPSS is very low (0.04%, 13th percentile).
Technical ContextAI
Flowise is a Node.js/TypeScript drag-and-drop builder for LLM orchestration flows, distributed via the npm package 'flowise'. The affected component is the account-registration API of its hosted Cloud offering. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), realized here as classic mass assignment / JSON injection: the /api/v1/account/register handler expects a minimal user object (name, email, credential) but the backend performs no strict allowlist or DTO validation and instead binds the raw client JSON directly onto internal domain models. Because the persistence layer trusts client-supplied values, attacker-controlled fields such as createdBy, updatedBy, createdDate, updatedDate and entire nested entities (organization, organizationUser, workspace, workspaceUser) are written verbatim. The affected product is identified by CPE cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*.
RemediationAI
Vendor-released patch: upgrade to Flowise 3.1.0, which fixes the mass-assignment flaw; the npm 'flowise' package is patched in 3.1.0 (vulnerable <= 3.0.13). If you cannot upgrade immediately, apply a server-side allowlist/DTO at the registration boundary so only name, email, and credential are accepted, and explicitly strip or reject any client-supplied organization, organizationUser, workspace, workspaceUser, roleId, createdBy, updatedBy, createdDate, and updatedDate fields - the trade-off is that this requires a code or reverse-proxy/WAF rule and must be kept in sync with the real schema. As a compensating control, place the /api/v1/account/register endpoint behind validation that rejects nested objects, and server-side reassign ownership/timestamp/role fields after account creation rather than trusting the payload; monitor for registrations that reference existing organization UUIDs. Reference the vendor advisory at https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-48m6-ch88-55mj for exact fix details.
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Flowise versions before 3.0.1 allow unauthenticated access to the Custom MCPs feature, which is designed to execute OS c
FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. Una
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Flowise is a drag & drop user interface to build a customized large language model flow. Rated critical severity (CVSS 9
Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthent
Missing authentication on NVD data endpoint in Flowise before 3.0.13 allows unauthenticated access to internal vulnerabi
Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDat
Remote command execution in Flowise <= 3.1.2 lets an authenticated user break out of the vm2/@flowiseai/nodevm JavaScrip
Arbitrary file read and write in FlowiseAI Flowise (versions 2.2.8 through 3.0.5) lets remote unauthenticated attackers
Authenticated remote code execution in FlowiseAI Flowise prior to 3.1.2 allows any user with a valid session or API key
Remote code execution in Flowise before 3.1.3 lets authenticated users abuse the Custom MCP node - when CUSTOM_MCP_PROTO
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today