7.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-46441

CVE-2026-46441: Flowise: Mass Assignment in Assistant Update Endpoint Allows Cross-Workspace Resource Reassignment

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the assistant update endpoint of FlowiseAI. The endpoint allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and updatedDate when updating an assistant resource. Due to missing server-side validation and authorization checks, an attacker can manipulate the workspaceId field and reassign assistants to arbitrary workspaces. This breaks tenant isolation in multi-workspace environments. This issue has been patched in version 3.1.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-46441

CVE-2026-46441:

7.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
flowise	npm	<= 3.1.1	3.1.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic mass assignment issue within the FlowiseAI backend, specifically in the service-layer functions responsible for creating and updating 'Assistant' resources. The root cause was the application's use of Object.assign(entity, requestBody), which blindly copies all properties from the user-controlled request body into the database entity. This allowed authenticated users to overwrite server-controlled fields, such as workspaceId, createdDate, and updatedDate, by simply adding them to the JSON body of a PUT /api/v1/assistants/{assistantId} request.

The patch, identified in commit faa571c961ee0ebe6fb9f4d060beb54e293ad39b, addresses this by introducing a stripProtectedFields utility function. This function acts as a denylist, creating a sanitized copy of the request body with all protected fields removed before the Object.assign operation is performed. This ensures that critical metadata remains under server control, mitigating the risk of cross-workspace data manipulation and other unauthorized modifications. The vulnerable functions, createAssistant and updateAssistant in packages/server/src/services/assistants/index.ts, were both patched to use this new sanitization function, effectively closing the vulnerability for both resource creation and updates.

Vulnerable functions

updateAssistant

packages/server/src/services/assistants/index.ts

The `updateAssistant` function was vulnerable to mass assignment. It directly used `Object.assign` to copy properties from the user-provided `requestBody` to the `Assistant` entity. This allowed an attacker to overwrite protected fields like `workspaceId`, `createdDate`, and `updatedDate` by including them in the JSON payload of the PUT request to `/api/v1/assistants/{assistantId}`. The patch fixes this by using a new `stripProtectedFields` utility function to remove sensitive fields from the request body before the assignment.

createAssistant

packages/server/src/services/assistants/index.ts

Similar to `updateAssistant`, the `createAssistant` function was also vulnerable to mass assignment. It used `Object.assign` to copy all properties from the `requestBody` into a new `Assistant` object. This would allow an attacker to set protected fields like `workspaceId` upon creation of a new assistant. The patch applies the same `stripProtectedFields` function to sanitize the input before creating the new entity.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.