Cross-Workspace Vulnerability in Flowise by FlowiseAI
CVE-2026-46479

7.7HIGH

Key Information:

Vendor

Flowiseai

Status
Flowise
Vendor
CVE Published:
8 June 2026

What is CVE-2026-46479?

Flowise, a drag-and-drop interface designed to create custom flows for large language models, contains a vulnerability prior to version 3.1.2 that allows for cross-workspace evaluation takeover through improper handling of mass-assignment in evaluation creation and updates. This flaw can potentially lead to unauthorized access and manipulation of user evaluations, posing a significant security risk. Users are strongly encouraged to update to the patched version 3.1.2 to mitigate this vulnerability.

Affected Version(s)

Flowise < 3.1.2

References

https://github.com/FlowiseAI/Flowise/security/advisories/...
x_refsource_CONFIRM
https://github.com/FlowiseAI/Flowise/releases/tag/flowise...
x_refsource_MISC

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.