CVE-2026-46476 Details
Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, CustomTemplate create and update mass-assignment allows cross-workspace template takeover. This issue has been patched in version 3.1.2.
A vulnerability in Flowise prior to version 3.1.2 allows for cross-workspace template takeover through mass assignment in the CustomTemplate creation and update processes. The issue arises because the application does not properly validate which fields can be overwritten, allowing authenticated users to manipulate workspace-specific data and disrupt workspace isolation. This flaw can be exploited by any user with permission to edit custom templates, potentially leading to unauthorized access and modification rights in another workspace.
Users should update to Flowise version 3.1.2 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.1.2 | [email protected] | ProductRelease Notes |
| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-728h-4mwj-f2p4 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| flowiseai flowise | < 3.1.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 15, 2026 | Initial Analysis | [email protected] |
| Jun 8, 2026 | New CVE Received | [email protected] |