CVE-2026-46479 Details
Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, evaluation create and update mass-assignment allows cross-workspace evaluation takeover. This issue has been patched in version 3.1.2.
A mass assignment vulnerability has been identified in Flowise versions prior to 3.1.2, specifically within the evaluations management feature. This issue allows an authenticated user to manipulate evaluation data across different workspaces, potentially leading to unauthorized access and modification of evaluation records. The vulnerability arises because the evaluation controller does not properly validate which fields can be updated, allowing client-controlled data to overwrite critical workspace-specific information. As a result, evaluations can be transferred between workspaces, disrupting data integrity and privacy.
Users can update to Flowise version 3.1.2 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-mq53-pc65-wjc4 | CISA-ADP | MitigationVendor Advisory |
| https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.1.2 | [email protected] | Release Notes |
| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-mq53-pc65-wjc4 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| flowiseai flowise | < 3.1.2 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 15, 2026 | Initial Analysis | [email protected] |
| Jun 8, 2026 | CVE Modified | CISA-ADP |
| Jun 8, 2026 | New CVE Received | [email protected] |