EUVD-2026-35109
GHSA-hp26-q66v-q2w7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconAuthenticate to Flowise instance
-
DeliveryEnumerate accessible assistantIds
-
ExploitIdentify target workspace UUID
-
InstallCraft PUT request with injected workspaceId field
-
C2Submit mass-assignment payload to /api/v1/assistants/{id}
-
ExecuteAssistant reassigned across tenant boundary
-
ImpactAccess or exfiltrate cross-workspace data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires (1) the target Flowise instance to be running a version at or below 3.1.1, (2) the attacker to hold valid authenticated credentials at any privilege level on the instance (PR:L per CVSS), (3) the attacker to know or guess the UUID of an existing assistantId they can update plus the UUID of a target workspaceId, and (4) the deployment to use the multi-workspace feature for the cross-tenant impact to be meaningful. Limits on exploitation: single-tenant or single-workspace deployments suffer only metadata tampering (createdDate/updatedDate) with no cross-tenant consequence; workspace UUIDs are not publicly enumerable, and SSVC rates this non-automatable because each target requires reconnaissance for valid IDs. No user interaction is required (UI:N). |
| Impact | The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) yields a 7.6 score reflecting network reach, high confidentiality and integrity impact, but with high attack complexity and required low-privileged authentication. SSVC aligns with this: Exploitation is rated 'poc' (publicly available exploit code exists in the GHSA advisory), Automatable is 'no' (requires valid credentials and knowledge of target workspaceId UUIDs), and Technical Impact is 'total' within the assistant resource scope. EPSS and CISA KEV data were not provided, so no public exploit identified at time of analysis in terms of confirmed active exploitation in the wild. Real-world risk is meaningful for SaaS or shared Flowise deployments where multiple tenants share a single instance, but limited for single-tenant or self-hosted single-workspace setups. The 'Authentication Bypass' tag is somewhat misleading - this is a horizontal privilege/tenant boundary bypass post-authentication, not credential bypass. |
| Exploit ScenarioDerived | An authenticated tenant user in a shared Flowise SaaS deployment captures a legitimate PUT /api/v1/assistants/{assistantId} request via browser DevTools, adds a workspaceId field pointing to a target tenant's UUID, and replays the request - the server persists the new workspaceId and the assistant (along with any embedded credentials or prompts) is reassigned to the attacker-controlled workspace. The GHSA advisory publishes a working PoC with the exact request body, lowering the barrier to exploitation, though the high CVSS attack complexity reflects the need to enumerate or guess target workspace UUIDs. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Cross-workspace tenant isolation bypass in FlowiseAI versions prior to 3.1.2 allows authenticated low-privileged users to reassign assistant resources to arbitrary workspaces by manipulating server-controlled fields in the assistant update endpoint. The flaw is a mass assignment issue (CWE-284) tracked as EUVD-2026-35109, with publicly available exploit code exists via the GHSA advisory PoC, though no public exploit identified at time of analysis as widely deployed exploitation. SSVC indicates total technical impact but non-automatable exploitation.
RemediationAI
Upgrade to vendor-released patch Flowise 3.1.2 or later, available at https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.1.2, which adds server-side DTO whitelisting and authorization checks on the assistant update endpoint along with related mass-assignment fixes in tools, variables, and user endpoints. If immediate upgrade is not feasible, place a reverse proxy or API gateway in front of Flowise that strips workspaceId, createdDate, and updatedDate fields from PUT /api/v1/assistants/* request bodies - this preserves legitimate update functionality but blocks the specific abuse, at the cost of maintaining a custom filter that must be revisited when the schema changes. Additionally restrict who can authenticate to Flowise (network ACLs, SSO enforcement) and audit existing assistants for unexpected workspaceId values, since the SSVC Exploitation rating of 'poc' confirms working exploit details are public in the GHSA advisory.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Flowise is an open-source drag-and-drop interface for building LLM application flows, distributed via npm as the 'flowise' package. The vulnerability resides in the PUT /api/v1/assistants/{assistantId} endpoint, which deserializes the JSON request body directly into the underlying database entity without DTO whitelisting, allowance lists, or authorization checks on protected fields. CWE-284 (Improper Access Control) manifests here as a classic mass assignment / over-posting flaw: server-controlled attributes such as workspaceId, createdDate, and updatedDate are exposed to client mutation. In multi-workspace deployments, workspaceId is the primary tenant boundary, so allowing client-supplied values for it collapses the multi-tenant security model. The affected CPE is cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:* covering all versions up to and including 3.1.1.
Know when Flowise gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the assistant update endpoint of FlowiseAI. The endpoint allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and updatedDate when updating an assistant resource. Due to missing server-side validation and authorization checks, an attacker can manipulate the workspaceId field and reassign assistants to arbitrary workspaces. This breaks tenant isolation in multi-workspace environments. This issue has been patched in version 3.1.2.
Executive ViewAI
FlowiseAI deployments prior to version 3.1.2 contain a tenant isolation bypass that allows authenticated users to access and reassign assistant resources across workspace boundaries, creating direct data exposure in multi-tenant environments. With publicly available exploit code, this vulnerability presents immediate risk to all organizations running FlowiseAI with multiple workspaces. Immediate patching to version 3.1.2 or later is required to prevent unauthorized cross-tenant access.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Flowise versions before 3.0.1 allow unauthenticated access to the Custom MCPs feature, which is designed to execute OS c
FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. Una
Arbitrary file read and write in Flowise versions prior to 3.0.8 allows an authenticated attacker with access to the flo
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Flowise is a drag & drop user interface to build a customized large language model flow. Rated critical severity (CVSS 9
Authenticated users can upload arbitrary files to Flowise 3.0.7 due to missing validation, enabling persistent storage o
Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthent
Missing authentication on NVD data endpoint in Flowise before 3.0.13 allows unauthenticated access to internal vulnerabi
Authenticated remote code execution in FlowiseAI Flowise (v3.0.1 up to but not including 3.0.8, and later versions when
Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDat
Remote code execution in FlowiseAI Flowise before 3.1.3 lets an attacker execute arbitrary OS commands as the Flowise pr
Exploit-DB