{"data":{"id":"b13245fc-89ea-4b8b-af2c-43c150f5c74b","title":"GHSA-78pr-c5x5-jggc: FlowiseAI: Assistant create+update mass-assignment allows cross-workspace assistant takeover","summary":"FlowiseAI's Assistant create and update paths copy the request body onto the entity with Object.assign without a field allowlist. An authenticated workspace member can therefore set workspaceId, and on create also id, to move an assistant into another workspace. The source states the flaw is fixed in PR 6128, which applies an allowlist pattern.","solution":"Already fixed in PR https://github.com/FlowiseAI/Flowise/pull/6128 (allowlist pattern applied).","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-78pr-c5x5-jggc","publishedAt":"2026-05-14T16:19:28.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["flowise@<= 3.1.1 (fixed: 3.1.2)"],"affectedPackageNames":["flowise"],"affectedPackageRefs":["npm:flowise"],"affectedVendors":[],"affectedVendorsRaw":["FlowiseAI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-78pr-c5x5-jggc"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-05-14T16:19:28.000Z","fixReleasedAt":"2026-04-14T10:52:03.012Z","daysToFix":-30,"fixCheckedAt":"2026-10-29T21:36:18.290Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"flowise","fixedVersion":"3.1.2","matchedVersion":"3.1.2","fixReleasedAt":"2026-04-14T10:52:03.012Z","daysToFix":-30,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:36:18.142Z"}]}}