CVE-2026-46477: Flowise Dataset Cross-Workspace Takeover (CVSS 8.8)

Technical summary

The vulnerability stems from improper handling of user-supplied input when creating or updating datasets. Mass-assignment flaws (CWE-915) occur when applications automatically bind request parameters to object properties without adequate validation or filtering. In this case, an authenticated attacker can craft requests that bypass workspace isolation controls, allowing them to modify or assume ownership of datasets outside their intended scope. The issue affects all Flowise versions prior to 3.1.2, where proper input sanitization and workspace boundary enforcement have been implemented.

Business impact

In multi-tenant Flowise environments, this vulnerability enables unauthorized dataset access and modification across organizational boundaries. An attacker with a standard user account could expose sensitive training data, manipulate model inputs, or disrupt workflows used by other teams. For organizations using Flowise to manage proprietary language models or customer-sensitive information, the risk extends to data confidentiality, integrity, and availability. The high CVSS score reflects the combination of network accessibility, low attack complexity, and the breadth of impact on all three security properties.

Affected systems

Flowise versions prior to 3.1.2 are affected. The vulnerability impacts any deployment where multiple workspaces or teams share a single Flowise instance, particularly where datasets contain sensitive or proprietary information. Standalone single-user or isolated deployments face lower risk, but the authentication requirement means internal or trusted users are the primary threat vector in such environments.

Exploitability

Exploitation requires a valid Flowise user account—there is no pre-authentication vector. Once authenticated, the attack is straightforward: an attacker simply submits a crafted dataset creation or update request with parameters designed to assign the dataset to a different workspace or user. The low attack complexity and absence of user interaction requirements mean that exploitation can be automated. Detection by other workspace users may be delayed if audit logging is not comprehensive.

Remediation

Upgrade Flowise to version 3.1.2 or later immediately. This patch version includes corrected input validation and workspace boundary enforcement in dataset operations. Organizations should also review audit logs for evidence of unauthorized dataset modifications or creation events that span multiple workspaces, particularly if version 3.1.2 was deployed after the original publication date.

Patch guidance

Apply version 3.1.2 or any subsequent stable release from the flowiseai project. Verify the upgrade through the Flowise administration interface or API endpoint that reports version information. Test the patch in a non-production environment first, particularly if you have custom workflows or integrations that depend on dataset APIs. After patching, run a brief validation that authenticated users can only access datasets within their assigned workspaces. If running a containerized deployment, ensure your container image is rebuilt from the patched source or updated from a vendor-provided image registry.

Detection guidance

Monitor Flowise API logs and audit trails for dataset creation or update requests originating from unexpected user accounts or occurring outside normal business patterns. Look for POST or PUT requests to dataset endpoints that reference workspace identifiers that do not match the authenticated user's assigned workspace. If your Flowise instance logs HTTP request bodies, examine them for suspicious parameter injection attempts. Database audit logs (if enabled) should show unexpected INSERT or UPDATE operations on dataset metadata tables tied to cross-workspace modifications.

Why prioritize this

This vulnerability merits immediate patching due to its high CVSS score (8.8), the confluence of confidentiality, integrity, and availability impact, and the low barrier to exploitation for any authenticated user. Although it requires authentication, organizations cannot rely on user trustworthiness in shared or federated environments. The risk is especially acute if datasets contain training data for sensitive models, customer information, or proprietary business logic.

Risk score, explained

The CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector yields a score of 8.8 (HIGH). Attack Vector: Network (any authenticated user can exploit remotely). Attack Complexity: Low (no special conditions needed). Privileges Required: Low (standard user account sufficient). User Interaction: None (fully automated). Scope: Unchanged (impact is confined to Flowise datasets, not system-wide). Confidentiality: High (full dataset exposure possible). Integrity: High (datasets can be modified or deleted). Availability: High (datasets can be rendered inaccessible to rightful owners). The combination of three 'High' impact properties with low attack friction justifies the HIGH severity rating.

Frequently asked questions