CVE-2026-91930: Flowise Auth Bypass Vulnerability

CVE-2026-91930 Overview

CVE-2026-91930 is a broken access control vulnerability in Flowise versions prior to 3.1.4. The enterprise organization and workspace membership APIs fail to scope requests to the calling user's tenant. Authenticated users can supply arbitrary organization identifiers to the organizationuser and workspace endpoints and be treated as legitimate members of the target tenant. Successful exploitation allows an attacker to add themselves as an organization owner, create workspaces inside a victim tenant, and obtain administrative control over resources belonging to other customers. The flaw is categorized under [CWE-266: Incorrect Privilege Assignment].

Critical Impact
Any authenticated Flowise user can escalate to organization owner across tenant boundaries, breaking multi-tenant isolation on affected deployments.

Affected Products

Flowise versions prior to 3.1.4
Enterprise deployments using organization and workspace features
Multi-tenant Flowise SaaS and self-hosted instances

Discovery Timeline

2026-09-15 - CVE-2026-91930 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-91930

Vulnerability Analysis

Flowise exposes REST endpoints under organizationuser and workspace that manage enterprise membership and tenant resources. These endpoints accept organization and workspace identifiers directly from the request body or path without validating that the authenticated caller belongs to the referenced tenant. An attacker who registers any account can therefore reference an arbitrary organization ID and manipulate its membership. The result is a horizontal-to-vertical privilege escalation across tenant boundaries.

The network-accessible attack surface, combined with only low privileges required, makes this issue practical for any tenant on a shared Flowise deployment. Confidentiality, integrity, and availability of victim organizations are all affected because organization owners can read prompts and credentials, modify pipelines, and remove other administrators.

Root Cause

The root cause is missing tenant scoping on the server-side authorization checks. The organizationuser and workspace handlers derive the target organization from user-controlled input rather than deriving it from the session context and enforcing membership. There is no server-side check that the caller's user record already belongs to the organization being modified before granting owner or workspace-creation rights.

Attack Vector

Exploitation requires only a valid authenticated Flowise account. The attacker sends crafted HTTP requests to the vulnerable membership endpoints, substituting the victim tenant's organization identifier. The server accepts the request and inserts the attacker as an organization owner or creates a new workspace inside the victim tenant. No user interaction from the victim is required, and no additional privileges beyond a standard authenticated account are needed. See the VulnCheck Advisory and the GitHub Security Advisory GHSA-pprx-4prj-35mj for endpoint-level detail.

// No verified public exploit code is available.
// Refer to the linked GitHub Security Advisory and VulnCheck advisory for technical detail.

Detection Methods for CVE-2026-91930

Indicators of Compromise

Unexpected additions to organizationuser records where the added user was not previously associated with the target organization.
Creation of new workspaces by user accounts that do not belong to the parent organization.
Authenticated HTTP requests to organizationuser or workspace endpoints containing organization IDs that differ from the caller's home tenant.
Sudden appearance of new organization owners followed by removal of existing administrators.

Detection Strategies

Review Flowise application logs for POST and PATCH requests to organizationuser and workspace endpoints and correlate the acting user's tenant with the referenced organization ID.
Query the database for organizationuser rows created after deployment where the user's original tenant does not match the assigned organization.
Alert on privilege changes that elevate a user to organization owner outside of an approved provisioning workflow.

Monitoring Recommendations

Forward Flowise access logs and audit trails to a centralized logging platform for cross-tenant anomaly analysis.
Baseline normal membership-change volume per tenant and alert on deviations.
Monitor authentication events for accounts that access multiple organization contexts in a short time window.

How to Mitigate CVE-2026-91930

Immediate Actions Required

Upgrade Flowise to version 3.1.4 or later on every self-hosted and managed instance.
Audit all organizationuser and workspace records created before the upgrade for unauthorized ownership changes.
Rotate API keys, credentials, and secrets stored inside any organization that shows evidence of unauthorized membership changes.
Force re-authentication of all users and review active sessions on the platform.

Patch Information

The vendor has released Flowise 3.1.4, which adds tenant-scoping checks to the affected organization and workspace endpoints. Refer to the GitHub Security Advisory GHSA-pprx-4prj-35mj for patch commits and upgrade notes.

Workarounds

Restrict network access to the Flowise application to trusted users and administrative networks until the patch is applied.
Disable self-service registration on multi-tenant deployments to limit the pool of authenticated attackers.
Place a reverse proxy or web application firewall in front of Flowise and block requests to organizationuser and workspace endpoints from user contexts that do not match the referenced organization.

bash

# Example: upgrade Flowise via npm
npm install -g flowise@3.1.4

# Or upgrade the container image
docker pull flowiseai/flowise:3.1.4
docker stop flowise && docker rm flowise
docker run -d --name flowise -p 3000:3000 flowiseai/flowise:3.1.4