{"data":{"id":"56e6e14c-12d2-4719-b0f1-a241e17a1a6a","title":"CVE-2026-41277: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Mass…","summary":"CVE-2026-41277 is a Mass Assignment flaw in the DocumentStore creation endpoint of Flowise, a drag-and-drop UI for building LLM flows, affecting versions prior to 3.1.0. Authenticated users can set the primary key (id) and internal state fields, so the repository.save() call acts as an implicit UPSERT that overwrites existing DocumentStore objects. In multi-workspace or multi-tenant deployments, this enables cross-workspace object takeover and IDOR, letting an attacker reassign or modify DocumentStore objects belonging to other workspaces.","solution":"Fixed in 3.1.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41277","publishedAt":"2026-04-23T20:16:16.410Z","cveId":"CVE-2026-41277","cweIds":["CWE-284","CWE-639","CWE-915"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["flowise@<= 3.0.13 (fixed: 3.1.0)"],"affectedPackageNames":["flowise"],"affectedPackageRefs":["npm:flowise"],"affectedVendors":[],"affectedVendorsRaw":["Flowise"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Flowise mass assignment in DocumentStore endpoint allows overwriting objects","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.03109,"epssCheckedAt":"2026-11-09T12:10:46.212Z","kevDateAdded":null,"advisoryAliases":["GHSA-3prp-9gf7-4rxx"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:49:11.957Z","patchAvailable":true,"disclosureDate":"2026-04-23T20:16:16.410Z","fixReleasedAt":"2026-03-16T14:47:16.783Z","daysToFix":-38,"fixCheckedAt":"2026-10-29T21:37:28.565Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"framework","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"flowise","fixedVersion":"3.1.0","matchedVersion":"3.1.0","fixReleasedAt":"2026-03-16T14:47:16.783Z","daysToFix":-38,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:37:28.419Z"}]}}