CVE-2026-91929: Flowise Enterprise Auth Bypass Vulnerability

CVE-2026-91929 Overview

CVE-2026-91929 is a cross-tenant authorization bypass in Flowise versions before 3.1.4. Enterprise endpoints fail to verify resource ownership before performing sensitive operations. Authenticated users with Enterprise access can delete arbitrary workspaces, invite themselves into other organizations, modify cross-organization roles, and abuse stored single sign-on (SSO) secrets. The flaw is tracked as a Missing Authorization weakness [CWE-862] and affects multi-tenant Flowise deployments where tenants share the same instance. Successful exploitation breaks tenant isolation and enables full takeover of unrelated organizations hosted on the same platform.

Critical Impact
An authenticated Enterprise user can pivot across tenant boundaries to delete workspaces, escalate roles in other organizations, and exfiltrate stored SSO secrets.

Affected Products

FlowiseAI Flowise versions prior to 3.1.4
Enterprise deployments exposing multi-tenant workspace, invitation, role, and SSO endpoints
Self-hosted Flowise instances shared across multiple organizations

Discovery Timeline

2026-09-15 - CVE-2026-91929 published to the National Vulnerability Database (NVD)
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-91929

Vulnerability Analysis

Flowise is an open-source builder for large language model (LLM) workflows and agents. The Enterprise tier introduces multi-tenant primitives such as organizations, workspaces, roles, invitations, and SSO configuration. Multiple Enterprise HTTP endpoints authenticate the caller but do not verify that the target resource belongs to the caller's tenant. Any authenticated Enterprise user can therefore issue requests referencing identifiers owned by other organizations and have those requests succeed.

The advisory identifies four exploitation primitives: arbitrary workspace deletion, self-invitation into foreign organizations, cross-organization role modification, and abuse of stored SSO secrets. Chained together, these primitives allow full compromise of any tenant on the same Flowise instance without exploiting a memory-safety or injection bug.

Root Cause

The root cause is missing object-level authorization on Enterprise controllers. Handlers trust the resource identifier supplied by the client and act on it after only checking that the caller is authenticated and holds an Enterprise role. There is no server-side check comparing the target resource's owning organization or workspace against the caller's session context. This is the classic pattern behind Broken Object Level Authorization and maps directly to [CWE-862] Missing Authorization.

Attack Vector

Exploitation requires network access to the Flowise API and low-privileged Enterprise credentials on the same instance. No user interaction is required. An attacker enumerates or guesses identifiers such as workspaceId, organizationId, or roleId, then invokes the vulnerable Enterprise endpoints to delete workspaces, insert themselves as members, elevate their role, or read SSO configuration secrets. Because stored SSO secrets can be reused, compromise may extend beyond Flowise into the victim organization's identity provider trust chain. Refer to the GitHub Security Advisory GHSA-7x8x-vv46-4579 and the VulnCheck advisory for endpoint-level detail.

Detection Methods for CVE-2026-91929

Indicators of Compromise

Unexpected workspace deletion events in Flowise audit logs, especially from accounts outside the workspace's owning organization.
Membership or invitation records showing users belonging to organizations they were never provisioned into.
Role change events where the acting user and the target user reside in different tenants.
Reads or exports of SSO configuration objects performed by non-administrator Enterprise accounts.

Detection Strategies

Correlate the acting user's organizationId with the target resource's organizationId on every mutating Enterprise API call and alert on mismatches.
Baseline invitation, role modification, and SSO-read volumes per account and flag statistical outliers.
Review reverse-proxy logs for enumeration patterns against /api/v1/organizations, /workspaces, /roles, and /sso endpoints.

Monitoring Recommendations

Forward Flowise application and audit logs into a centralized SIEM or data lake for cross-tenant correlation.
Monitor authentication logs for reuse of stored SSO client secrets or signing keys after the disclosure date.
Track the deployed Flowise version through software inventory and alert on any instance running a build older than 3.1.4.

How to Mitigate CVE-2026-91929

Immediate Actions Required

Upgrade Flowise to version 3.1.4 or later on every Enterprise instance.
Rotate all stored SSO client secrets, signing keys, and OAuth credentials referenced by Flowise Enterprise configuration.
Audit organization membership, workspace ownership, and role assignments for unauthorized changes since the vulnerable version was first deployed.
Restrict Enterprise account provisioning and revoke unused or unknown Enterprise users.

Patch Information

The maintainers fixed the missing authorization checks in Flowise 3.1.4. Upgrade instructions and the list of hardened endpoints are documented in GitHub Security Advisory GHSA-7x8x-vv46-4579.

Workarounds

Place vulnerable Flowise instances behind an authenticating reverse proxy that restricts access to trusted operators until the patch is applied.
Temporarily disable Enterprise multi-tenant features and consolidate workloads into single-tenant instances per organization.
Enforce network segmentation so that untrusted Enterprise users cannot reach cross-tenant API paths.

bash

# Upgrade Flowise to the patched release
npm install -g flowise@3.1.4

# Verify the installed version
flowise --version