EUVD-2026-25296
GHSA-3prp-9gf7-4rxx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L for an authenticated user and AC:H because the attacker must first obtain a valid cross-workspace UUID; high confidentiality/integrity impact from overwriting another tenant's objects, low availability.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
6DescriptionGitHub Advisory
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Mass Assignment vulnerability in the DocumentStore creation endpoint allows authenticated users to control the primary key (id) and internal state fields of DocumentStore entities. Because the service uses repository.save() with a client-supplied primary key, the POST create endpoint behaves as an implicit UPSERT operation. This enables overwriting existing DocumentStore objects. In multi-workspace or multi-tenant deployments, this can lead to cross-workspace object takeover and broken object-level authorization (IDOR), allowing an attacker to reassign or modify DocumentStore objects belonging to other workspaces. This vulnerability is fixed in 3.1.0.
AnalysisAI
Cross-workspace object takeover in Flowise (versions prior to 3.1.0) lets authenticated low-privilege users overwrite DocumentStore records belonging to other workspaces. The DocumentStore create endpoint accepts a client-supplied primary key and persists it via TypeORM repository.save(), turning the POST into an implicit UPSERT that can UPDATE another tenant's record and reassign or modify it. SSVC rates technical impact as total and lists proof-of-concept exploitation; EPSS is low (0.05%), and it is not on CISA KEV.
Technical ContextAI
Flowise is a low-code/drag-and-drop builder for LLM orchestration flows built on Node.js with TypeORM as its persistence layer (npm package 'flowise', CPE cpe:2.3:a:flowiseai:flowise). The root cause is CWE-284 (Improper Access Control) manifesting as a mass-assignment / broken-object-level-authorization flaw: the DocumentStore entity uses @PrimaryGeneratedColumn('uuid') for a globally unique id that is NOT composite with workspaceId. The create handler runs repo.create(newDocumentStore) then repo.save(documentStore) with no DTO allowlist or field filtering, so the entire request body - including id, status, and internal state fields - is bound to the entity. TypeORM's save() performs an UPDATE when the supplied primary key already exists and an INSERT otherwise, so a client-controlled id converts creation into an upsert with no ownership check before persistence.
RemediationAI
Vendor-released patch: upgrade to Flowise 3.1.0, which fixes the mass-assignment/upsert behavior; this is the primary and recommended action per GHSA-3prp-9gf7-4rxx (https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-3prp-9gf7-4rxx). If immediate upgrade is not possible, compensating controls include placing the DocumentStore create/API endpoints behind a reverse proxy or WAF rule that rejects requests whose JSON body contains an 'id' field on the create path (side effect: may break legitimate clients that send full objects), tightly restricting who is granted workspace accounts since any authenticated user can trigger cross-workspace writes, and consolidating to single-workspace deployments where feasible to remove the cross-tenant premise (side effect: loses multi-tenant isolation). Additionally monitor DocumentStore records for unexpected workspaceId reassignment or field changes. Do not rely on network-level controls alone, since exploitation requires an already-authenticated user.
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Flowise versions before 3.0.1 allow unauthenticated access to the Custom MCPs feature, which is designed to execute OS c
FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. Una
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Flowise is a drag & drop user interface to build a customized large language model flow. Rated critical severity (CVSS 9
Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthent
Missing authentication on NVD data endpoint in Flowise before 3.0.13 allows unauthenticated access to internal vulnerabi
Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDat
Remote command execution in Flowise <= 3.1.2 lets an authenticated user break out of the vm2/@flowiseai/nodevm JavaScrip
Arbitrary file read and write in FlowiseAI Flowise (versions 2.2.8 through 3.0.5) lets remote unauthenticated attackers
Authenticated remote code execution in FlowiseAI Flowise prior to 3.1.2 allows any user with a valid session or API key
Remote code execution in Flowise before 3.1.3 lets authenticated users abuse the Custom MCP node - when CUSTOM_MCP_PROTO
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today