PT-2026-41212 · Flowiseai+2 · Flowise
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Flowise versions prior to 3.1.2
Description
A mass assignment issue exists in the dataset create and update processes. The application uses
Object.assign() to copy the request body into a Dataset entity without an explicit field allowlist, allowing a client to overwrite sensitive fields. Specifically, an authenticated user can manipulate the workspaceId and id variables via the PUT /api/v1/datasets/<id> endpoint. This allows an attacker to move a dataset from one workspace to another by specifying a different workspaceId, resulting in a cross-workspace dataset takeover and Insecure Direct Object Reference (IDOR). This occurs because the persistence layer saves the client-controlled values directly to the database, breaking workspace isolation.Recommendations
Update to version 3.1.2.
As a temporary workaround, restrict access to the
PUT /api/v1/datasets/<id> endpoint or monitor for requests containing the workspaceId or id parameters in the request body.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Flowise