HighVulnerability
GHSA-5wxp-qjgq-fx6m: FlowiseAI has Mass Assignment in Chatflow Update Endpoint that Allows Cross-Workspace AgentFlow Reassignment
- Identifiers
- CVE-2026-42863GHSA-5wxp-qjgq-fx6m
- Published
- Record updated
- Affected
- flowise <= 3.1.1
- Fixed in
- 3.1.2
- released April 14, 2026, 30 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.3%
Summary
A mass assignment flaw in the PUT /api/v1/chatflows/{chatflowId} endpoint of FlowiseAI lets an authenticated user set server-controlled fields such as deployed, isPublic, workspaceId, createdDate and updatedDate, because the request body is merged directly into the chatflow model without a DTO whitelist or authorization checks. In testing, a chatflow was reassigned to a second workspace, which breaks tenant isolation in multi-tenant deployments and may expose private workflows or alter deployed agent workflows.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- flowisenpmLLM dependency since 2024-03-12
Related items
- MediumCVE-2026-102610: fast-agent serve unauthenticated remote command execution via /mcp endpointSimilar attack · NVD/CVE Database
- CriticalCVE-2026-58490: Tracecat SAML authentication bypass through unsigned responses in Docker ComposeSimilar attack · NVD/CVE Database
- MediumCVE-2026-124028: mistral.rs delimiter injection allows attacker-chosen tool calls via quoted textSimilar attack · NVD/CVE Database
- HighCVE-2026-123974: TorchServe local privilege escalation via predictable /tmp extraction directorySimilar attack · NVD/CVE Database
- InfoOpenAI Says New GPT-6 Cyber Model Hunts Flaws Without Crossing the LineSimilar attack · SecurityWeek