CVE-2026-42863: Flowise: Mass Assignment in Chatflow Update Endpoint Allows Cross-Workspace AgentFlow Reassignment

Synopsis

A mass assignment vulnerability in FlowiseAI's Flowise chatflow update endpoint allows an authenticated user to overwrite server-controlled fields such as workspaceId, deployed, isPublic, createdDate, and updatedDate. The endpoint is reachable over the network and requires only a low-privilege account, with no interaction from any other user needed. Successful exploitation lets an attacker reassign a chatflow to a different workspace and manipulate deployment and visibility settings without authorization. A patched-image rebuild at version 3.1.2 is available on HarborGuard for environments running an affected version of Flowise.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The chatflow update endpoint is exposed over the network, so an attacker must be able to reach the Flowise service via HTTP to send the malicious request.

• AuthenticationRequired

  Any low-privilege account is sufficient; the attacker needs valid credentials to call the chatflow update endpoint but does not need admin rights.

• Victim interactionNot required

  The attacker sends a crafted API request directly; no action from another user or administrator is needed to complete the exploit.

• Attack complexityDetail

  Attack complexity is rated High, meaning the exploit depends on environmental conditions or timing factors beyond the attacker's direct control, such as knowing a target workspaceId.

Blast Radius

• Reads sensitive chatflow configurations, including internal deployment state and visibility settings, belonging to other workspaces.
• Modifies the workspaceId field to reassign a chatflow to an arbitrary workspace, breaking tenant isolation.
• Tampers with the isPublic and deployed fields to change whether a chatflow is publicly accessible or actively serving traffic without authorization.