CVE-2026-91929 FlowiseAI CVE debrief

Who should care

Defenders responsible for Flowise Enterprise deployments should assess exposure and verify versions, as attackers with Enterprise access can exploit these authorization gaps. Operators, administrators, and security teams managing Flowise Enterprise should review configurations and ensure proper authorization to prevent potential unauthorized actions.

Why it matters

CVE-2026-91929 Flowise cross-tenant authorization gaps require verification of Flowise versions before 3.1.4 and Enterprise endpoint configurations to prevent potential unauthorized actions.

• Potential unauthorized workspace deletion
• Possible unauthorized role modifications
• Potential abuse of stored SSO secrets
• Verification of Flowise version and Enterprise endpoint configurations required

Technical summary

Flowise versions before 3.1.4 contain cross-tenant authorization gaps in Enterprise endpoints, allowing attackers with Enterprise access to delete arbitrary workspaces, invite themselves into other organizations, modify cross-org roles, and abuse stored SSO secrets. The vulnerability requires verification of Flowise versions before 3.1.4 and Enterprise endpoint configurations to prevent potential unauthorized actions. Defenders should prioritize verifying Flowise versions before 3.1.4 for cross-tenant authorization gaps and ensuring upgrade to 3.1.4 or later.

Defensive priority

Defenders should prioritize verifying Flowise versions before 3.1.4 for cross-tenant authorization gaps and ensuring upgrade to 3.1.4 or later.

Recommended defensive actions

• Verify Flowise version and upgrade to 3.1.4 or later if necessary
• Review Enterprise endpoint configurations for proper authorization
• Monitor for suspicious activity related to workspace deletion and role modifications
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE description notes Flowise versions before 3.1.4 contain cross-tenant authorization gaps in Enterprise endpoints. The NVD entry is currently Deferred. Evidence is limited to CVE description and NVD entry. Defenders should verify Flowise versions and Enterprise endpoint configurations for potential exposure. Limited source detail suggests explicit evidence-limit language and defensive verification tasks are required.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.