Mass Assignment Vulnerability in Flowise DocumentStore by FlowiseAI

CVE-2026-41277

What is CVE-2026-41277?

The Flowise application, a user-friendly interface for creating customized large language model flows, is affected by a Mass Assignment vulnerability in the DocumentStore creation endpoint. This flaw permits authenticated users to manipulate the primary key and internal state fields of DocumentStore entities. By leveraging this vulnerability, an attacker could overwrite existing DocumentStore objects, potentially leading to unauthorized reassignment or modification of objects across different workspaces in multi-tenant environments. The issue arises from the use of a client-supplied primary key in the repository.save() method, which functions as an implicit UPSERT operation. This vulnerability emphasizes the need for robust object-level authorization mechanisms to prevent such exploits. A fix has been implemented in version 3.1.0.

References