PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46479 FlowiseAI CVE debrief

CVE-2026-46479 is a high-severity vulnerability in Flowise, a drag & drop user interface to build customized large language model flows. The vulnerability, with a CVSS score of 7.7, allows for cross-workspace evaluation takeover due to mass-assignment issues in evaluation create and update operations. This issue was patched in version 3.1.2 of Flowise.

Vendor
FlowiseAI
Product
Flowise
CVSS
HIGH 7.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-08
Original CVE updated
2026-07-23
Advisory published
2026-06-08
Advisory updated
2026-07-23

Who should care

Users of Flowise, especially those who manage large language model flows across multiple workspaces, should be aware of this vulnerability. It is crucial for them to update to version 3.1.2 or later to mitigate the risk of cross-workspace evaluation takeover.

Technical summary

The vulnerability in Flowise arises from mass-assignment issues in the create and update operations for evaluations. This allows an attacker with low privileges to take over evaluations across different workspaces, potentially leading to unauthorized access and manipulation of sensitive data and models.

Defensive priority

High

Recommended defensive actions

  • Update Flowise to version 3.1.2 or later.
  • Review and restrict evaluation create and update operations to ensure proper authorization and validation of user input.
  • Monitor Flowise instances for any suspicious activity related to evaluations.

Evidence notes

The CVE record and details were obtained from official sources, including CVE.org and the National Vulnerability Database (NVD).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46479 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46479

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46479 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46479

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.