{"data":{"id":"12f42caa-8508-447d-822a-17138d2b717e","title":"GHSA-mq53-pc65-wjc4: FlowiseAI: Evaluation create+update mass-assignment allows cross-workspace evaluation takeover","summary":"FlowiseAI's Evaluation create and update paths copy the request body into the entity with Object.assign(...) and no field allowlist. An authenticated workspace member can therefore send a workspaceId in the body, which is persisted and moves the evaluation into another workspace, along with any data it holds. The source says the flaw is fixed in PR 6050 using an allowlist pattern, matching the DocumentStore fix in commit 840d2ae.","solution":"Fixed in PR https://github.com/FlowiseAI/Flowise/pull/6050, which applies an explicit field allowlist to the Evaluation entity, matching commit 840d2ae for DocumentStore.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-mq53-pc65-wjc4","publishedAt":"2026-05-14T16:19:49.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["flowise@<= 3.1.1 (fixed: 3.1.2)"],"affectedPackageNames":["flowise"],"affectedPackageRefs":["npm:flowise"],"affectedVendors":[],"affectedVendorsRaw":["FlowiseAI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-mq53-pc65-wjc4"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-05-14T16:19:49.000Z","fixReleasedAt":"2026-04-14T10:52:03.012Z","daysToFix":-30,"fixCheckedAt":"2026-10-29T21:36:15.268Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"flowise","fixedVersion":"3.1.2","matchedVersion":"3.1.2","fixReleasedAt":"2026-04-14T10:52:03.012Z","daysToFix":-30,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:36:15.121Z"}]}}