PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42861 FlowiseAI CVE debrief

A high-severity vulnerability exists in FlowiseAI Flowise, allowing authenticated users to manipulate workspace IDs and reassign variables to arbitrary workspaces. This issue, CVE-2026-42861, has been patched in version 3.1.2.

Vendor
FlowiseAI
Product
Flowise
CVSS
HIGH 7.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-08
Original CVE updated
2026-07-23
Advisory published
2026-06-08
Advisory updated
2026-07-23

Who should care

Users of FlowiseAI Flowise, especially those in multi-workspace environments, should be aware of this vulnerability and take action to protect themselves.

Technical summary

A mass assignment vulnerability exists in the variable update endpoint of FlowiseAI Flowise. The endpoint allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and updatedDate when updating a variable resource. Due to missing server-side validation and authorization checks, an attacker can manipulate the workspaceId field and reassign variables to arbitrary workspaces. This behavior may break tenant isolation in multi-workspace environments.

Defensive priority

high

Recommended defensive actions

  • Upgrade to FlowiseAI Flowise version 3.1.2 or later.
  • Review and restrict access to the variable update endpoint.
  • Implement additional validation and authorization checks for workspaceId and other server-controlled properties.

Evidence notes

CVE-2026-42861 has a CVSS score of 7.6 and is considered HIGH severity. The vulnerability was published on 2026-06-08T16:16:39.503Z and modified on 2026-06-11T03:53:34.103Z.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-42861 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-42861

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-42861 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-42861

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.