CVE-2026-46480: Flowise Mass-Assignment Vulnerability Allows Cross-Workspace Evaluator Takeover

Technical summary

CVE-2026-46480 is a mass-assignment vulnerability affecting Flowise versions prior to 3.1.2. The evaluator create and update endpoints fail to properly validate or restrict which workspace-scoped resources a user can modify. An authenticated user can supply additional parameters during API requests to modify evaluators outside their workspace context, resulting in cross-workspace access and control. The vulnerability is classified under CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes), a pattern where applications allow attackers to set arbitrary object properties via request parameters without sufficient authorization checks.

Business impact

Successful exploitation enables unauthorized modification of evaluator configurations across organizational boundaries within a Flowise instance. An attacker could alter AI evaluation logic, redirect outputs, access sensitive prompts or model configurations, or sabotage workflows used by other teams. For organizations using Flowise to manage production LLM pipelines, this represents a significant integrity and confidentiality risk. Multi-tenant deployments are especially vulnerable, as compromise of one workspace does not require breaking authentication—only leveraging existing credentials to exceed intended scope.

Affected systems

Flowise versions before 3.1.2 are affected. The vulnerability impacts the evaluator management subsystem, which may be used in any Flowise deployment, particularly those supporting multiple workspaces or teams. Organizations running Flowise with shared environments, API integrations, or user-created flows that depend on evaluators are at highest risk. The issue does not affect Flowise 3.1.2 and later.

Exploitability

This vulnerability has a high exploitability profile. It requires only valid user credentials—no special access level, no interaction with other users, and no complex manipulation. An attacker with a standard user account can craft API requests with modified parameters to access and modify evaluators in other workspaces. The attack is straightforward to automate and difficult to detect without detailed API logging. No known public exploit has been referenced in KEV; however, the technical simplicity makes weaponization trivial once the vulnerability is disclosed.

Remediation

Upgrade Flowise to version 3.1.2 or later, which patches the mass-assignment vulnerability by implementing proper authorization controls on evaluator endpoints. The patch enforces workspace-scoped access validation, ensuring users can only view and modify evaluators within their assigned workspace. Organizations should verify against the Flowise release notes to confirm the update version deployed in their environment.

Patch guidance

Apply Flowise version 3.1.2 or higher. Before upgrading, test the new version in a staging environment to ensure compatibility with existing workflows and integrations. Document any custom evaluators or extensions in use, as the patch may affect their behavior if they rely on undocumented parameter handling. After deployment, audit workspace membership and evaluator ownership to detect any unauthorized changes that may have occurred during the vulnerability window.

Detection guidance

Monitor Flowise API logs for evaluator create and update requests originating from users outside the target evaluator's workspace. Look for requests to `/evaluators` endpoints with workspace IDs that do not match the authenticated user's assigned workspaces. Enable verbose logging on the evaluator subsystem and review for suspicious parameter values or batch operations. Implement alerting on cross-workspace resource modification attempts. Organizations using intrusion detection systems should correlate Flowise logs with network activity to identify lateral movement patterns.

Why prioritize this

This vulnerability scores 8.8 (HIGH) because it requires only low-privilege authentication to achieve high-impact outcomes: confidentiality, integrity, and availability of evaluators and their associated workflows can all be compromised. The attack surface is accessible to any user with credentials, including contractors, partners, or compromised accounts with minimal privileges. In multi-tenant or shared Flowise instances, the blast radius is potentially organization-wide. Although no active exploitation is currently tracked in KEV, the simplicity of the attack and sensitivity of LLM configurations warrant immediate patching.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: (AV:N) network-accessible API requiring no special network positioning; (AC:L) low complexity—standard HTTP requests with modified parameters; (PR:L) low privilege—any authenticated user; (UI:N) no user interaction needed; (S:U) impact isolated to the application scope; (C:H/I:H/A:H) complete compromise of evaluator confidentiality, integrity, and availability. The metric combination elevates the score despite the authentication requirement because the privilege level needed is minimal and the impact on targeted resources is complete.

Frequently asked questions