CVE-2026-46478: Flowise DatasetRow Mass-Assignment Cross-Workspace Takeover (8.8 HIGH)

Technical summary

CVE-2026-46478 is a mass-assignment vulnerability (CWE-915) in Flowise prior to 3.1.2 that affects the DatasetRow creation and update endpoints. The vulnerability allows an authenticated user to specify parameters that should be restricted by the application, enabling them to modify the workspace association or ownership of dataset rows. An attacker with valid credentials can craft requests that assign or transfer rows across workspace boundaries, bypassing intended isolation controls. The issue stems from insufficient input validation and parameter filtering on the affected API endpoints.

Business impact

This vulnerability poses significant risk to multi-tenant Flowise deployments. An attacker with a valid user account in one workspace could compromise confidentiality and integrity of another organization's dataset rows. In environments where Flowise is used to manage sensitive training data, prompts, or evaluation datasets for language model pipelines, unauthorized cross-workspace access could expose proprietary information, alter model training inputs, or disrupt AI/ML operations. Organizations running shared or SaaS-style Flowise instances face elevated exposure.

Affected systems

Flowise versions prior to 3.1.2 are affected. The vulnerability requires authentication, so it does not impact unauthenticated or disconnected deployments. Organizations running Flowise in multi-user or multi-tenant configurations are at highest risk; single-user or air-gapped instances face reduced practical exposure.

Exploitability

Exploitation requires valid Flowise credentials, making this a low-barrier attack for internal threats or compromised user accounts. The attack vector is network-accessible, requires minimal user interaction, and does not depend on race conditions or complex prerequisites. An attacker can exploit this without administrative rights, using standard API calls to move or modify dataset rows. No known public exploit code is referenced in the CISA KEV catalog, but the straightforward nature of mass-assignment attacks means weaponized proof-of-concept code could emerge rapidly post-disclosure.

Remediation

Organizations must upgrade Flowise to version 3.1.2 or later. This patch implements proper parameter validation and workspace isolation controls to prevent cross-workspace row modification. Patches should be deployed to all affected instances, including development, staging, and production environments. Post-patch verification should confirm that dataset rows remain isolated by workspace and that authenticated users cannot modify rows outside their assigned scope.

Patch guidance

Upgrade Flowise to version 3.1.2 or any release published after the patch date (verify against the vendor advisory for the exact versioning scheme and any additional fixes bundled in that release). If operating on a version prior to 3.1.2, prioritize this upgrade in your next maintenance window. Review any vendor guidance on potential data inconsistencies or rollback procedures, as the patch may affect how existing cross-workspace rows are handled. Test the upgrade in a non-production environment first to confirm compatibility with custom workflows or integrations.

Detection guidance

Monitor API logs for DatasetRow create and update requests, particularly those originating from users outside the expected workspace context. Look for requests containing workspace identifiers that do not match the authenticated user's home workspace. Implement log aggregation for API endpoint access patterns and flag any attempts to modify rows with workspace IDs different from the user's primary assignment. Review audit trails for unexpected ownership changes or transfers of dataset rows between workspaces. Alerting on cross-workspace modifications to sensitive datasets is recommended.

Why prioritize this

This vulnerability scores 8.8 (HIGH) due to its network accessibility, low complexity, and high impact on confidentiality, integrity, and availability. Authentication is required but is a realistic prerequisite in multi-tenant deployments where users often have access across environments. The ability to corrupt or exfiltrate another organization's data from the same Flowise instance warrants priority treatment, especially if the deployment hosts sensitive model training data or evaluation datasets.

Risk score, explained

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network accessibility (AV:N), no special conditions required for exploitation (AC:L), and a requirement for valid credentials (PR:L). The impact is high across all three security properties: confidentiality (data exfiltration), integrity (unauthorized modification), and availability (potential disruption via data corruption). The score of 8.8 correctly represents a serious but not critical flaw, since exploitation requires prior authentication and does not cross trust boundaries outside a single deployment.

Frequently asked questions