PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46476 FlowiseAI CVE debrief

CVE-2026-46476 is a HIGH severity vulnerability in Flowise, a drag & drop user interface to build customized large language model flows. The issue allows for a cross-workspace template takeover due to CustomTemplate create and update mass-assignment. This vulnerability was patched in version 3.1.2.

Vendor
FlowiseAI
Product
Flowise
CVSS
HIGH 7.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-08
Original CVE updated
2026-07-23
Advisory published
2026-06-08
Advisory updated
2026-07-23

Who should care

Users of Flowise, especially those hosting it in a multi-workspace environment, should be aware of this vulnerability. An attacker with low privileges could potentially exploit this issue to take over templates across different workspaces.

Technical summary

The vulnerability exists in the CustomTemplate create and update functionality of Flowise, allowing for mass-assignment. This could lead to a cross-workspace template takeover. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 7.7, indicating a HIGH severity level.

Defensive priority

HIGH

Recommended defensive actions

  • Users of Flowise should update to version 3.1.2 or later to mitigate this vulnerability.
  • Review and restrict the permissions of users who can create and update CustomTemplates.
  • Monitor for any suspicious activity related to template modifications.

Evidence notes

The CVE-2026-46476 vulnerability was published on [cve-org] and additional details can be found on [nvd]. The vendor has released a patch for this issue, which is documented in [ref-4] and [ref-5].

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46476 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46476

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46476 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46476

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.