PT-2026-34732 · Flowise · Flowise

Published 2026-04-16 · Updated 2026-04-23 · CVE-2026-41267

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.0

Description An improper mass assignment (JSON injection) issue exists in the account registration endpoint of Flowise Cloud. This allows unauthenticated attackers to inject server-managed fields and nested objects during account creation, enabling client-controlled manipulation of ownership metadata, timestamps, organization association, and role mappings, which breaks trust boundaries in a multi-tenant environment.

Recommendations Update to version 3.1.0.

Exploit

Fix

IDOR

RCE

Weakness Enumeration

CWE-639

CWE-915

CWE-20

Related Identifiers

CVE-2026-41267

GHSA-48M6-CH88-55MJ

Affected Products

Flowise

References · 5

• 🔥 https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-48m6-ch88-55mj · Exploit
• https://osv.dev/vulnerability/GHSA-48m6-ch88-55mj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41267 · Security Note
• https://github.com/FlowiseAI/Flowise · Note
• https://twitter.com/CVEnew/status/2047428079317066189 · Twitter Post