PT-2026-34745 · Flowise · Flowise

Published 2026-04-17 · Updated 2026-04-23 · CVE-2026-41277

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.0

Description A Mass Assignment issue in the DocumentStore creation endpoint allows authenticated users to control the primary key id and internal state fields of DocumentStore entities. Since the service uses the repository.save() function with a client-supplied primary key, the POST create endpoint acts as an implicit UPSERT operation, which is a database operation that updates an existing record if it exists or inserts a new one if it does not. This allows for the overwriting of existing DocumentStore objects. In multi-workspace or multi-tenant deployments, this can result in cross-workspace object takeover and broken object-level authorization, enabling an attacker to reassign or modify DocumentStore objects belonging to other workspaces.

Recommendations Update to version 3.1.0.

Exploit

Fix

Improper Access Control

IDOR

Weakness Enumeration

CWE-284

CWE-639

CWE-915

Related Identifiers

CVE-2026-41277

GHSA-3PRP-9GF7-4RXX

Affected Products

Flowise

References · 5

• 🔥 https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-3prp-9gf7-4rxx · Exploit
• https://osv.dev/vulnerability/GHSA-3prp-9gf7-4rxx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41277 · Security Note
• https://github.com/FlowiseAI/Flowise · Note
• https://twitter.com/CVEnew/status/2047428070014177388 · Twitter Post