CVE-2026-46476: Flowise Auth Bypass Vulnerability

CVE-2026-46476 Overview

CVE-2026-46476 is a mass-assignment vulnerability in Flowise, a drag-and-drop interface for building large language model (LLM) workflows. The flaw resides in the CustomTemplate create and update endpoints. Attackers with low-privileged workspace access can manipulate unprotected object attributes to take over templates owned by other workspaces. The vulnerability affects all Flowise versions prior to 3.1.2 and is tracked as CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes. The maintainers patched the issue in version 3.1.2.

Critical Impact
Authenticated users in one workspace can hijack or modify CustomTemplate objects belonging to other workspaces, breaking tenant isolation and exposing confidentiality, integrity, and availability of LLM workflow assets.

Affected Products

Flowise versions prior to 3.1.2
FlowiseAI Flowise LLM orchestration platform
Multi-tenant Flowise deployments using workspace isolation

Discovery Timeline

2026-06-08 - CVE-2026-46476 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-46476

Vulnerability Analysis

Flowise allows users to create and manage CustomTemplate objects through API endpoints that accept JSON payloads. The create and update handlers bind the incoming request body directly to template model fields without filtering which attributes a client is permitted to set. This pattern, known as mass assignment, lets an authenticated user supply attributes such as workspaceId, ownerId, or equivalent tenancy markers when calling the endpoint.

Because the server trusts the client-supplied values, the requesting user can create or update a template whose ownership pointer references another workspace. The result is cross-workspace template takeover: a low-privileged attacker in workspace A can overwrite or claim templates belonging to workspace B. In a multi-tenant Flowise instance, this defeats the workspace boundary that customers rely on for data separation.

Root Cause

The root cause is improperly controlled modification of dynamically-determined object attributes [CWE-915]. The Flowise CustomTemplate controller does not enforce an allowlist of writable fields. Tenancy-defining fields are mutable through the same request body used for benign template metadata, so authorization checks on the route do not prevent privilege boundary violations at the data layer.

Attack Vector

An attacker needs network access to the Flowise API and valid low-privileged credentials in any workspace on the instance. The attacker submits a crafted POST or PUT request to the CustomTemplate endpoint and includes additional fields that re-target the object to a foreign workspace or template ID. No user interaction is required. Successful exploitation grants full read and write control over the targeted template, allowing the attacker to inject malicious prompt logic, exfiltrate proprietary template content, or delete templates in use by other tenants.

No public proof-of-concept code has been released. Technical details are available in the GitHub Security Advisory GHSA-728h-4mwj-f2p4.

Detection Methods for CVE-2026-46476

Indicators of Compromise

CustomTemplate API requests containing tenancy fields such as workspaceId, ownerId, or id in the JSON body submitted by non-administrative users.
Audit log entries showing CustomTemplate create or update events where the resulting workspaceId differs from the requesting user's workspace.
Unexpected appearance, modification, or disappearance of CustomTemplate objects across workspace boundaries.

Detection Strategies

Inspect HTTP request bodies to /api/v1/templates and related CustomTemplate routes for unexpected attributes beyond name, description, and template payload fields.
Correlate authenticated session workspace context with the workspaceId field persisted on newly created or updated templates and alert on mismatches.
Hunt historical application logs for PUT or POST requests to CustomTemplate endpoints originating from low-privileged accounts that target template identifiers outside their workspace.

Monitoring Recommendations

Enable verbose API request logging on the Flowise service, including request bodies for write operations, and forward logs to a centralized SIEM.
Track the running Flowise version across all deployments and alert when any instance reports a version earlier than 3.1.2.
Monitor for anomalous template enumeration patterns, such as a single user issuing requests referencing many template IDs in a short window.

How to Mitigate CVE-2026-46476

Immediate Actions Required

Upgrade Flowise to version 3.1.2 or later on every deployment that hosts multi-workspace tenants.
Audit all existing CustomTemplate objects to confirm workspaceId ownership matches the expected tenant and revert any unauthorized changes.
Rotate API tokens and session credentials for any workspace where unauthorized template changes are suspected.

Patch Information

FlowiseAI released the fix in Flowise 3.1.2. The patch restricts which attributes the CustomTemplate create and update handlers accept from client input, enforcing server-side ownership assignment based on the authenticated session context.

Workarounds

Restrict network access to the Flowise API so only trusted users and services can reach the CustomTemplate endpoints until the upgrade is applied.
Place a reverse proxy or web application firewall in front of Flowise to strip workspaceId, ownerId, and similar tenancy fields from CustomTemplate request bodies.
Temporarily disable CustomTemplate creation and update functionality for non-administrative roles where role-based controls allow.

bash

# Verify the installed Flowise version and upgrade to the patched release
npm list -g flowise
npm install -g flowise@3.1.2

# For Docker-based deployments
docker pull flowiseai/flowise:3.1.2
docker stop flowise && docker rm flowise
docker run -d --name flowise -p 3000:3000 flowiseai/flowise:3.1.2