7.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42863

CVE-2026-42863: Flowise: Mass Assignment in Chatflow Update Endpoint Allows Cross-Workspace AgentFlow Reassignment

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the chatflow update endpoint of FlowiseAI. The endpoint allows clients to modify server-controlled properties such as deployed, isPublic, workspaceId, createdDate, and updatedDate when updating a chatflow object. Due to missing server-side validation and authorization checks, an authenticated user can manipulate internal attributes of a chatflow and reassign it to another workspace. This allows cross-workspace resource reassignment and unauthorized modification of deployment and visibility settings. This issue has been patched in version 3.1.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42863

CVE-2026-42863:

7.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
flowise	npm	<= 3.1.1	3.1.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a mass assignment issue in the FlowiseAI chatflow update endpoint (PUT /api/v1/chatflows/{chatflowId}), allowing an authenticated user to modify server-controlled properties of a chatflow object. The analysis of the patch in commit 0d29e4d0dfa3119c4ace89f615340d40b0615c9e confirms the root cause.

The primary vulnerable function is updateChatflow located in packages/server/src/controllers/chatflows/index.ts. Before the patch, this function directly assigned the user-controlled request body to a ChatFlow entity using Object.assign(updateChatFlow, body). This allowed an attacker to inject and modify protected fields like workspaceId, isPublic, and deployed. The fix involves sanitizing the request body with a new stripProtectedFields utility before the assignment.

A similar vulnerability was proactively fixed in the saveChatflow function in the same file, which is responsible for creating chatflows.

Furthermore, a defense-in-depth fix was applied to the updateChatflow function within the service layer at packages/server/src/services/chatflows/index.ts. This change ensures that the workspaceId is always derived from a trusted source, preventing reassignment even if the initial sanitization were to fail. During an exploit, a runtime profile would show a call stack involving these identified functions.

Vulnerable functions

updateChatflow

packages/server/src/controllers/chatflows/index.ts

This function is the request handler for the `PUT /api/v1/chatflows/{chatflowId}` endpoint. It was vulnerable to mass assignment because it directly used `Object.assign` to merge the user-provided request body into the `updateChatFlow` object without filtering out protected fields. This allowed an authenticated attacker to modify sensitive, server-controlled properties such as `workspaceId`, leading to cross-workspace resource reassignment.

saveChatflow

packages/server/src/controllers/chatflows/index.ts

This function handles the creation of new chatflows. It contained the same mass assignment vulnerability as `updateChatflow`, where it would merge the user-provided request body without sanitization using `Object.assign`. Although the security advisory focuses on the update endpoint, the patch proactively fixed this function to prevent a similar vulnerability during chatflow creation.

updateChatflow

packages/server/src/services/chatflows/index.ts

This service-layer function is called by the controller's `updateChatflow` function. The patch adds a defense-in-depth measure by explicitly setting the `workspaceId` from a trusted parameter, rather than relying on the potentially tainted `workspaceId` from the merged object. This indicates that this function was part of the vulnerable code path, processing the malicious data before it was persisted.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.