Improper Mass Assignment Vulnerability in Flowise Cloud by Flowise

CVE-2026-41267

What is CVE-2026-41267?

Flowise Cloud, a user-friendly interface for building customized large language models, is susceptible to an improper mass assignment vulnerability in its account registration endpoint. This issue allows unauthenticated users to manipulate server-controlled fields and nested objects when creating accounts. Consequently, this exploitation can result in unauthorized modifications to ownership metadata, timestamps, organization associations, and role mappings, thereby compromising the security and integrity of user data in a multi-tenant architecture. The vulnerability was addressed in version 3.1.0.

References