PT-2026-41215 · Flowiseai+2 · Flowise
CVE-2026-46480
·
Published
2026-05-14
·
Updated
2026-06-08
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Flowise versions prior to 3.1.2
Description
A mass assignment issue exists in the evaluator create and update processes. The server uses
Object.assign() to copy the request body into the Evaluator entity without an explicit field allowlist, allowing a client to overwrite sensitive fields such as workspaceId, id, createdDate, and updatedDate. An authenticated attacker can exploit this by sending a request to the PUT /api/v1/evaluators/<id> endpoint with a modified workspaceId variable, effectively moving an evaluator to a different workspace. This results in a cross-workspace boundary violation and insecure direct object reference (IDOR), where the attacker can transfer ownership of an evaluator to another workspace whose UUID is known or enumerated.Recommendations
Update to version 3.1.2.
As a temporary workaround, restrict access to the
PUT /api/v1/evaluators/<id> endpoint or monitor for requests containing the workspaceId variable in the request body.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Flowise