EUVD-2026-25296
GHSA-3prp-9gf7-4rxx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege Flowise user
-
DeliveryObtain or enumerate target DocumentStore UUID
-
ExploitPOST create with victim id and modified fields
-
Executionsave() performs UPDATE not INSERT
-
ImpactOverwrite record and reassign workspace ownership
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated Flowise account (PR:L) and a multi-workspace or multi-tenant deployment for the cross-workspace impact to matter. The concrete prerequisite is possession of a valid, existing DocumentStore UUID belonging to another workspace - the attacker must obtain or enumerate this id (reflected as AT:P Attack Requirement), which is the primary limiting factor since ids are random UUIDs. Exploitation targets the POST DocumentStore create endpoint and depends on the pre-3.1.0 code path that calls repository.save() with a client-supplied primary key and no ownership/workspace scoping. No user interaction is required. Single-tenant installations are not meaningfully exposed to the cross-workspace takeover, though the mass-assignment of internal state fields still applies. |
| Impact | The supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L) scores 7.6 (High): network-reachable, low attacker privileges required, but with an Attack Requirement (AT:P) reflecting the need to know or enumerate a valid target DocumentStore UUID. SSVC aligns partly - Technical Impact: total and Exploitation: poc - but Automatable: no, consistent with the AT:P prerequisite that prevents trivial mass exploitation. EPSS is very low (0.05%, 15th percentile) and the CVE is NOT in CISA KEV, so there is no evidence of widespread or active exploitation. The signals are internally consistent rather than conflicting: high impact and a working concept, gated by an authenticated foothold plus knowledge of a cross-tenant UUID. This is a genuine priority specifically for multi-workspace/multi-tenant Flowise deployments; single-tenant installs face materially lower real-world risk since the cross-workspace takeover premise does not apply. |
| Exploit ScenarioDerived | An authenticated user in tenant A obtains or enumerates a DocumentStore UUID belonging to tenant B, then sends a POST to the DocumentStore create endpoint with that id plus attacker-chosen name, status, and config fields. Because save() sees an existing primary key it performs an UPDATE, overwriting tenant B's record and potentially reassigning its workspace ownership. A proof-of-concept is indicated by the SSVC 'poc' rating and the advisory includes an illustrative request body. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 24, 2026
Cross-workspace object takeover in Flowise (versions prior to 3.1.0) lets authenticated low-privilege users overwrite DocumentStore records belonging to other workspaces. The DocumentStore create endpoint accepts a client-supplied primary key and persists it via TypeORM repository.save(), turning the POST into an implicit UPSERT that can UPDATE another tenant's record and reassign or modify it. SSVC rates technical impact as total and lists proof-of-concept exploitation; EPSS is low (0.05%), and it is not on CISA KEV.
RemediationAI
Vendor-released patch: upgrade to Flowise 3.1.0, which fixes the mass-assignment/upsert behavior; this is the primary and recommended action per GHSA-3prp-9gf7-4rxx (https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-3prp-9gf7-4rxx). If immediate upgrade is not possible, compensating controls include placing the DocumentStore create/API endpoints behind a reverse proxy or WAF rule that rejects requests whose JSON body contains an 'id' field on the create path (side effect: may break legitimate clients that send full objects), tightly restricting who is granted workspace accounts since any authenticated user can trigger cross-workspace writes, and consolidating to single-workspace deployments where feasible to remove the cross-tenant premise (side effect: loses multi-tenant isolation). Additionally monitor DocumentStore records for unexpected workspaceId reassignment or field changes. Do not rely on network-level controls alone, since exploitation requires an already-authenticated user.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Flowise is a low-code/drag-and-drop builder for LLM orchestration flows built on Node.js with TypeORM as its persistence layer (npm package 'flowise', CPE cpe:2.3:a:flowiseai:flowise). The root cause is CWE-284 (Improper Access Control) manifesting as a mass-assignment / broken-object-level-authorization flaw: the DocumentStore entity uses @PrimaryGeneratedColumn('uuid') for a globally unique id that is NOT composite with workspaceId. The create handler runs repo.create(newDocumentStore) then repo.save(documentStore) with no DTO allowlist or field filtering, so the entire request body - including id, status, and internal state fields - is bound to the entity. TypeORM's save() performs an UPDATE when the supplied primary key already exists and an INSERT otherwise, so a client-controlled id converts creation into an upsert with no ownership check before persistence.
Know when Flowise gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
PR:L for an authenticated user and AC:H because the attacker must first obtain a valid cross-workspace UUID; high confidentiality/integrity impact from overwriting another tenant's objects, low availability.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Mass Assignment vulnerability in the DocumentStore creation endpoint allows authenticated users to control the primary key (id) and internal state fields of DocumentStore entities. Because the service uses repository.save() with a client-supplied primary key, the POST create endpoint behaves as an implicit UPSERT operation. This enables overwriting existing DocumentStore objects. In multi-workspace or multi-tenant deployments, this can lead to cross-workspace object takeover and broken object-level authorization (IDOR), allowing an attacker to reassign or modify DocumentStore objects belonging to other workspaces. This vulnerability is fixed in 3.1.0.
Executive ViewAI
Flowise versions prior to 3.1.0 contain a cross-workspace data integrity vulnerability enabling authenticated low-privilege users to modify or reassign documents belonging to other workspaces. This threatens data confidentiality and integrity across organizational boundaries in multi-tenant deployments; proof-of-concept exploitation code is publicly available, though the vulnerability has not been observed in active attacks.
Apply vendor patch to version 3.1.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Flowise versions before 3.0.1 allow unauthenticated access to the Custom MCPs feature, which is designed to execute OS c
FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. Una
Arbitrary file read and write in Flowise versions prior to 3.0.8 allows an authenticated attacker with access to the flo
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Flowise is a drag & drop user interface to build a customized large language model flow. Rated critical severity (CVSS 9
Authenticated users can upload arbitrary files to Flowise 3.0.7 due to missing validation, enabling persistent storage o
Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthent
Missing authentication on NVD data endpoint in Flowise before 3.0.13 allows unauthenticated access to internal vulnerabi
Authenticated remote code execution in FlowiseAI Flowise (v3.0.1 up to but not including 3.0.8, and later versions when
Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDat
Remote code execution in FlowiseAI Flowise before 3.1.3 lets an attacker execute arbitrary OS commands as the Flowise pr
Exploit-DB