CVE-2026-41277: 
Flowise vulnerability analysis and mitigation

CVE-2026-41277 is a Mass Assignment vulnerability in Flowise's DocumentStore creation endpoint that allows authenticated users to control the primary key (id) and internal state fields of DocumentStore entities, enabling cross-workspace object takeover (IDOR). It affects all Flowise versions up to and including 3.0.13 (prior to 3.1.0). The vulnerability was published on April 23, 2026, and patched in version 3.1.0. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 7.6 (High) (GitHub Advisory, Red Hat CVE).

The root cause is a combination of CWE-284 (Improper Access Control), CWE-639 (Authorization Bypass Through User-Controlled Key), and CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes). The DocumentStore service passes the full, unfiltered request body directly to repository.save() without a DTO allowlist or field filtering, and because TypeORM's save() performs an UPDATE when the supplied primary key already exists, the POST /api/v1/document-store endpoint effectively acts as an implicit UPSERT. An authenticated attacker who obtains or enumerates a valid DocumentStore UUID from another workspace can submit a crafted POST request with that UUID to overwrite the target record, including potentially reassigning its workspaceId. No DTO allowlisting, no ownership validation before save(), and globally unique (non-composite) UUIDs collectively enable this attack (GitHub Advisory).

Successful exploitation allows an authenticated attacker to overwrite existing DocumentStore objects belonging to other workspaces, resulting in high confidentiality impact (unauthorized access to embedding configurations, vector store settings, and AI workflow data), high integrity impact (modification or reassignment of critical DocumentStore configurations), and availability disruption of affected DocumentStore objects. In multi-tenant or SaaS deployments, this breaks tenant isolation and object-level authorization, potentially enabling an attacker to redirect AI pipeline data indexing and retrieval to their own workspace or corrupt another tenant's workflow execution (GitHub Advisory).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, including a step-by-step exploitation sequence using a crafted HTTP POST request with an attacker-controlled id field to hijack existing DocumentStore objects across workspaces (GitHub Advisory). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.117%, indicating low but non-zero probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Authenticate: Obtain valid credentials for any workspace in the target Flowise instance (e.g., via a free trial or low-privilege account).
2. Create a DocumentStore in your workspace: Send a normal POST request to /api/v1/document-store to create a DocumentStore and observe the UUID returned in the API response.
3. Enumerate or obtain a target UUID: Identify a valid DocumentStore UUID belonging to another workspace. This may be obtained through API enumeration, information disclosure, or social engineering.
4. Craft the malicious UPSERT request: From your authenticated session (Workspace B), submit a POST request to /api/v1/document-store with the victim's UUID in the id field:

POST /api/v1/document-store
Content-Type: application/json
Authorization: Bearer <your_token>

{
  "id": "<victim-workspace-documentstore-uuid>",
  "name": "hijacked",
  "description": "hijacked",
  "workspaceId": "<attacker-workspace-id>",
  "embeddingConfig": "...",
  "vectorStoreConfig": "..."
}

5. Trigger implicit UPDATE: Because repository.save() detects the existing primary key, it performs an UPDATE rather than an INSERT, overwriting the victim's DocumentStore record with attacker-supplied values.
6. Achieve cross-workspace takeover: If workspaceId is overwritten, the DocumentStore is effectively reassigned to the attacker's workspace, granting full control over the victim's embedding provider, vector store configuration, and AI workflow data (GitHub Advisory).

• Network: Unexpected POST requests to /api/v1/document-store containing a pre-existing UUID in the request body from an authenticated session not associated with the owning workspace; cross-workspace API calls where the authenticated user's workspace ID differs from the workspaceId in the payload.
• Logs: Application logs showing DocumentStore records being updated (rather than created) via the POST create endpoint; log entries where the id field in a create request matches an existing record's UUID; repeated POST requests to /api/v1/document-store with varying UUIDs suggesting enumeration.
• Database: DocumentStore records with unexpected workspaceId values or ownership changes not initiated by the owning workspace's users; audit trail gaps where a record's updatedAt timestamp changes without a corresponding update action from the legitimate owner.

Upgrade Flowise to version 3.1.0 or later, which resolves this vulnerability by implementing proper DTO allowlisting and ownership validation before persistence (GitHub Advisory). For organizations unable to patch immediately, restrict access to the DocumentStore creation endpoint (POST /api/v1/document-store) to trusted authenticated users only, and implement additional network-level or application-level authorization controls to prevent cross-workspace access. Monitor DocumentStore modification logs for suspicious activity, particularly POST create requests that result in updates to existing records.

The vulnerability was reported by security researcher berkdedekarginoglu and disclosed via GitHub's coordinated security advisory process on April 15, 2026, with public CVE assignment on April 23, 2026 (GitHub Advisory). Red Hat has tracked the CVE in their security database (Red Hat CVE). No significant broader media coverage or notable social media commentary has been identified beyond standard vulnerability database aggregation.