This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-42862 | BDVDB-2026-338586 Detail

FlowiseAIFlowise

Description#

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the tool update endpoint of FlowiseAI. The endpoint allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and updatedDate when updating a tool resource. Due to missing server-side validation and authorization checks, an attacker can manipulate the workspaceId field and reassign tools to arbitrary workspaces. This breaks tenant isolation in multi-workspace environments. This issue has been patched in version 3.1.2.

Impact#

Per CVSS v4.0: confidentiality impact high, integrity impact high, availability impact none. Attack vector: network.

Weaknesses#

  • CWE-284 Improper Access Control
  • CWE-639 Authorization Bypass Through User-Controlled Key
  • CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.