CVE-2026-41277 - Vulnerability Analysis

Overview

Flowise < 3.1.0 contains a broken access control caused by mass assignment in DocumentStore creation endpoint, letting authenticated users overwrite DocumentStore objects across workspaces, exploit requires authentication.

Severity & Score

Impact

Authenticated attackers can overwrite or reassign DocumentStore objects across workspaces, leading to broken object-level authorization and data tampering.

Mitigation

Update to version 3.1.0 or later.

References

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-3prp-9gf7-4rxx

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner