CVE-2026-46475: Flowise Auth Bypass Vulnerability

CVE-2026-46475 Overview

CVE-2026-46475 is a mass-assignment vulnerability in Flowise, a drag-and-drop interface for building customized large language model (LLM) flows. The flaw affects assistant create and update operations prior to version 3.1.2. Attackers with low-privilege access can manipulate request payloads to assign attributes that should be server-controlled. This enables cross-workspace assistant takeover, allowing an authenticated user in one workspace to seize control of assistants belonging to other workspaces. The issue is tracked under CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes. FlowiseAI patched the issue in version 3.1.2.

Critical Impact
Authenticated attackers can take over assistants across workspace boundaries, compromising the confidentiality, integrity, and availability of LLM assistant configurations.

Affected Products

Flowise versions prior to 3.1.2
Self-hosted Flowise deployments exposing the assistant create and update endpoints
Multi-tenant Flowise instances with multiple workspaces

Discovery Timeline

2026-06-08 - CVE-2026-46475 published to NVD
2026-06-09 - Last updated in NVD database
Version 3.1.2 - FlowiseAI releases security patch addressing the mass-assignment flaw

Technical Details for CVE-2026-46475

Vulnerability Analysis

The vulnerability resides in the assistant create and update workflows within Flowise. These endpoints accept user-supplied attributes and bind them directly to internal assistant objects without enforcing an allow-list of mutable fields. As a result, an authenticated attacker can submit additional or modified properties beyond those intended for client control. Among the affected attributes are identifiers that determine workspace ownership of an assistant. By assigning these values, an attacker can re-parent an existing assistant to their own workspace or modify assistants owned by another workspace.

The practical outcome is a tenancy boundary failure. Multi-tenant Flowise deployments rely on workspace isolation to separate customers, teams, or projects. The mass-assignment flaw bypasses that isolation entirely at the assistant resource layer.

Root Cause

The root cause is the absence of a server-side schema that restricts which fields a client may supply on assistant create and update requests. The handler trusts the incoming payload and merges it into the persisted object, including fields that govern ownership and access. This pattern matches [CWE-915] precisely: dynamically-determined object attributes are modified using attacker-controlled input.

Attack Vector

Exploitation requires network access to the Flowise API and a valid low-privilege account. The attacker issues a crafted HTTP request to the assistant create or update endpoint and includes additional JSON properties referencing another workspace's identifiers or the target assistant's identifier. No user interaction is needed. Because the attack is performed through the standard API surface, requests appear well-formed and may not stand out in baseline web logs. See the GitHub Security Advisory GHSA-78pr-c5x5-jggc for additional technical context.

No verified public exploit code is currently available, so synthetic exploitation samples are omitted.

Detection Methods for CVE-2026-46475

Indicators of Compromise

Assistant records whose workspace identifier changed without a corresponding administrative action in audit logs.
API requests to assistant create or update endpoints containing fields such as workspace, owner, or tenant identifiers that clients should not normally supply.
Unexpected appearance of assistants in a workspace, or disappearance from another, near in time to authenticated API activity from a single user.

Detection Strategies

Compare the JSON keys submitted to /api/v1/assistants create and update routes against an allow-list of expected client fields and alert on extras.
Correlate workspace ownership changes on assistant objects with the authenticated user that issued the modifying request.
Hunt for authenticated users issuing assistant update requests targeting assistant identifiers they do not own according to historical baselines.

Monitoring Recommendations

Enable verbose API request logging in Flowise and forward logs to a centralized analytics platform for query and retention.
Monitor authentication and authorization audit trails for low-privilege accounts performing assistant modifications across multiple workspaces.
Track the Flowise version in use across deployments and alert when instances run versions earlier than 3.1.2.

How to Mitigate CVE-2026-46475

Immediate Actions Required

Upgrade Flowise to version 3.1.2 or later, available from the Flowise 3.1.2 release notes.
Audit all assistants and confirm their workspace ownership matches the expected tenant before re-exposing the service.
Rotate API tokens and session credentials for any account that may have been used to exploit the vulnerability.

Patch Information

FlowiseAI fixed CVE-2026-46475 in Flowise 3.1.2. The patch restricts which attributes the assistant create and update handlers accept from client input, preventing mass-assignment to ownership and workspace fields. Full details are published in GHSA-78pr-c5x5-jggc.

Workarounds

Restrict Flowise API access to trusted networks and identities while the upgrade is scheduled.
Limit assistant create and update privileges to a small set of administrative accounts and remove these rights from regular workspace users until patched.
Place an API gateway or reverse proxy in front of Flowise to strip unexpected JSON fields from assistant create and update requests.

bash

# Upgrade Flowise to the patched version
npm install -g flowise@3.1.2

# Or for Docker-based deployments
docker pull flowiseai/flowise:3.1.2
docker stop flowise && docker rm flowise
docker run -d --name flowise -p 3000:3000 flowiseai/flowise:3.1.2