CVE-2026-46475: Flowise Mass-Assignment Privilege Escalation (v3.1.2 Patch)

Technical summary

CVE-2026-46475 is a mass-assignment vulnerability (CWE-915) affecting Flowise versions before 3.1.2. The vulnerability exists in the assistant create and update endpoints, which fail to properly restrict which fields can be modified by an authenticated user. This allows an attacker with valid credentials to bypass workspace isolation controls and assume ownership of or modify assistants in other workspaces, resulting in cross-workspace compromise. The attack requires authentication but no user interaction and impacts the confidentiality, integrity, and availability of affected assistants.

Business impact

A successful exploit permits an authenticated insider or compromised account to access proprietary LLM flows, prompt templates, and configurations across workspace boundaries. This poses risks to intellectual property theft, data exfiltration through model interactions, and disruption of AI-driven business processes. Organizations using Flowise for multi-tenant or multi-team deployments face heightened risk of lateral movement and unauthorized model manipulation.

Affected systems

Flowise versions prior to 3.1.2 are vulnerable. The vulnerability affects any deployment where multiple users or workspaces share a single Flowise instance. Self-hosted and cloud-based deployments are equally at risk if not patched.

Exploitability

The vulnerability has a CVSS score of 8.8 (HIGH) and carries a low attack complexity. It requires valid authentication credentials but no user interaction to execute. Network accessibility is not restricted. The barrier to exploitation is moderate—an attacker must have or obtain valid Flowise credentials—but the attack itself is straightforward once authenticated. This vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the published date.

Remediation

Update Flowise to version 3.1.2 or later immediately. Organizations should verify their current Flowise version and deploy patches across all affected instances. If immediate patching is not possible, restrict Flowise access to trusted internal networks and implement strong authentication controls to reduce the likelihood of credential compromise.

Patch guidance

Upgrade to Flowise version 3.1.2 or any later release. Patch deployment should be prioritized for instances serving multiple workspaces or teams, or those handling sensitive LLM workflows. Verify the upgrade by checking the Flowise version string in the application interface or via the vendor advisory. Test the update in a non-production environment first to ensure compatibility with existing workflows and custom integrations.

Detection guidance

Monitor Flowise API logs for suspicious create or update requests to assistant endpoints originating from unexpected user accounts or IP addresses. Look for requests that reference assistant IDs outside the user's assigned workspace. Audit logs may reveal unauthorized assistant modifications or ownership changes. Network-level detection should flag any authenticated sessions making bulk or rapid modifications to shared resources across workspace boundaries. Alert on failed access attempts to cross-workspace assistants if logging is available.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score, ease of exploitation by authenticated users, and direct impact on data confidentiality and integrity. Organizations using Flowise for production LLM workflows should treat patching as urgent, particularly if the deployment serves multiple teams or customers. The low attack complexity and broad access impact justify prioritization above many other vulnerabilities.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: (1) network-accessible endpoints requiring only authentication, (2) high impact on confidentiality (unauthorized access to assistants and LLM flows), integrity (modification of shared configurations), and availability (potential deletion or disablement of assistants), (3) low attack complexity (no special conditions or tricks required), and (4) privilege escalation across workspace isolation boundaries. The score does not include organizational risk factors such as multi-tenant deployments or the sensitivity of hosted LLM models.

Frequently asked questions