CVE-2026-46478 Details

A mass assignment vulnerability has been identified in Flowise versions prior to 3.1.2, allowing cross-workspace row takeover in the DatasetRow entity. The issue arises because the DatasetRow controller mass-assigns client-controlled data, including workspace IDs, without proper validation. This flaw enables authenticated users to manipulate dataset rows across different workspaces, violating data isolation and potentially exposing sensitive information.

Users should update to Flowise version 3.1.2 or later, where this vulnerability has been patched. The update process can be done through the standard package management tools for the Node.js ecosystem.