CVE-2026-46477 Details
Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, dataset create and update mass-assignment allows cross-workspace dataset takeover. This issue has been patched in version 3.1.2.
A mass assignment vulnerability has been identified in Flowise, a user interface for building customized large language model flows. This issue, present in versions prior to 3.1.2, allows for cross-workspace dataset takeover by exploiting the dataset creation and update processes. The vulnerability arises because the Dataset controller does not properly validate which fields can be overwritten, enabling authenticated users to manipulate dataset ownership and access through the workspaceId field.
Users can update to Flowise version 3.1.2 or later, where this vulnerability has been patched. The update is available on the Flowise GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.1.2 | [email protected] | ProductRelease Notes |
| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-5h9v-837x-m97r | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| flowiseai flowise | < 3.1.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 15, 2026 | Initial Analysis | [email protected] |
| Jun 8, 2026 | New CVE Received | [email protected] |