Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| flowise | npm | <= 3.1.1 | 3.1.2 |
Miggo AIRoot Cause AnalysisThe vulnerability is a mass assignment issue in FlowiseAI's custom template feature, allowing an authenticated user to take over custom templates belonging to other workspaces. The root cause is the use of Object.assign(entity, body) in the service layer, which copies all fields from the incoming request body into the database entity without a proper allowlist.
The analysis of the patch commit f64047bdcf4cbd6a30ec348b9e3f2899ff514e89 reveals two key functions involved in this vulnerability:
saveCustomTemplate in packages/server/src/controllers/marketplaces/index.ts: This is the controller function that handles the API request to save a custom template. In the vulnerable version, it passes the entire request body (req.body) directly to the service layer. This function is the entry point for the exploit.
saveCustomTemplate in packages/server/src/services/marketplaces/index.ts: This is the service function that contains the core vulnerability. It uses Object.assign(customTemplate, body) to populate a CustomTemplate entity. An attacker can include a workspaceId field in the request body to move the template to a different workspace, or an id field to cause an IDOR.
The fix applied in the patch involves using a stripProtectedFields function to remove sensitive fields like id, workspaceId, createdDate, and updatedDate from the request body before it is used in the Object.assign call. This prevents attackers from manipulating these fields.
During an exploit, a profiler would likely show a call to the controller function saveCustomTemplate, which in turn calls the vulnerable service function saveCustomTemplate. Therefore, both functions are critical indicators of this vulnerability being triggered.
saveCustomTemplatepackages/server/src/services/marketplaces/index.ts
saveCustomTemplatepackages/server/src/controllers/marketplaces/index.ts