Cross-Workspace Evaluator Takeover in Flowise by FlowiseAI
CVE-2026-46480

7.7HIGH

Key Information:

Vendor

Flowiseai

Status
Flowise
Vendor
CVE Published:
8 June 2026

What is CVE-2026-46480?

Flowise, a drag-and-drop user interface designed for customizing large language model flows, contains a vulnerability that allows for cross-workspace evaluator takeover. This flaw exists in the evaluator's mass-assignment functionality and poses a significant risk to user data integrity. The issue has been addressed and patched in version 3.1.2, urging all users to update promptly to mitigate potential security threats.

Affected Version(s)

Flowise < 3.1.2

References

https://github.com/FlowiseAI/Flowise/security/advisories/...
x_refsource_CONFIRM
https://github.com/FlowiseAI/Flowise/releases/tag/flowise...
x_refsource_MISC

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.