CVE-2026-41277
Prior to 3.1.0, a Mass Assignment vulnerability in the DocumentStore creation endpoint allows authenticated users to control the primary key (id) and internal state fields of DocumentStore entities.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.11%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Mass Assignment vulnerability in the DocumentStore creation endpoint allows authenticated users to control the primary key (id) and internal state fields of DocumentStore entities. Because the service uses repository.save() with a client-supplied primary key, the POST create endpoint behaves as an implicit UPSERT operation. This enables overwriting existing DocumentStore objects. In multi-workspace or multi-tenant deployments, this can lead to cross-workspace object takeover and broken object-level authorization (IDOR), allowing an attacker to reassign or modify DocumentStore objects belonging to other workspaces. This vulnerability is fixed in 3.1.0.
- CVSS 4.0
- 7.6 HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 3.11% probability · 87th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-284, CWE-639, CWE-915
- Affected
- flowiseai/flowise
- Source
- security-advisories@github.com
References
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-3prp-9gf7-4rxxExploit, Vendor Advisory
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-3prp-9gf7-4rxxExploit, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.