Description
A weakness has been identified in FlowiseAI Flowise up to 3.0.12. Affected by this vulnerability is an unknown functionality of the component User Controller Handler. This manipulation of the argument userId/organizationId/workspaceId/email causes authorization bypass. The attack may be initiated remotely. The affected component should be upgraded.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| FlowiseAI | Flowise | 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, 3.0.12 | — |
Advisories 1
- WID-SEC-2026-1392 Flowise: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen BSI CERT-Bund (WID) · May 6, 2026
References
- VDB-361274 | FlowiseAI Flowise User Controller authorization vdb-entry technical-description
- VDB-361274 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #777657 | FlowiseAI Flowise <= 3.0.12 Authorization Bypass Through User-Controlled Key (CWE-639) third-party-advisory
- https://gist.github.com/YLChen-007/3584e6ffa0bba6367328ecf0b46b0e4b related