GHSA-48m6-ch88-55mj: Flowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association

Summary

GHSA-48m6-ch88-55mj describes an improper mass assignment flaw in the POST /api/v1/account/register endpoint of Flowise Cloud. The backend maps client-supplied JSON directly to internal models without an allowlist or DTO validation, so an unauthenticated attacker can set organization, organizationUser, role and timestamp fields during registration. The source says this lets an attacker attach a new account to an existing organization they do not belong to, with a chosen role, across a multi-tenant boundary.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• flowisenpmLLM dependency since 2024-03-12

Related items

• MediumFake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents EarlySimilar attack · The Hacker News
• MediumRansomware extortion gets personal as attackers target employees’ familiesSimilar attack · CSO Online
• MediumLangflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit AttemptsSimilar attack · The Hacker News
• MediumAnthropic 'SneakPeek' Flaw Is a Silent Zero-Click ThreatSimilar attack · Dark Reading
• HighCVE-2026-104103: Ludwig archive extraction allows writes outside extraction directorySimilar attack · NVD/CVE Database