{"data":{"id":"02a13b75-ec08-4a7a-a886-7c0e5dd574e4","title":"GHSA-48m6-ch88-55mj: Flowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association","summary":"GHSA-48m6-ch88-55mj describes an improper mass assignment flaw in the POST /api/v1/account/register endpoint of Flowise Cloud. The backend maps client-supplied JSON directly to internal models without an allowlist or DTO validation, so an unauthenticated attacker can set organization, organizationUser, role and timestamp fields during registration. The source says this lets an attacker attach a new account to an existing organization they do not belong to, with a chosen role, across a multi-tenant boundary.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-48m6-ch88-55mj","publishedAt":"2026-04-16T21:44:24.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["flowise@<= 3.0.13 (fixed: 3.1.0)"],"affectedPackageNames":["flowise"],"affectedPackageRefs":["npm:flowise"],"affectedVendors":[],"affectedVendorsRaw":["Flowise","Flowise Cloud"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-48m6-ch88-55mj"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-04-16T21:44:24.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}