7.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-46480

CVE-2026-46480: Flowise: Evaluator create+update mass-assignment allows cross-workspace evaluator takeover

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, evaluator create and update mass-assignment allows cross-workspace evaluator takeover. This issue has been patched in version 3.1.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-46480

CVE-2026-46480:

7.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
flowise	npm	<= 3.1.1	3.1.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a mass assignment issue within FlowiseAI's server, specifically affecting the creation and updating of 'Evaluator' and 'Evaluation' entities. The root cause lies in the use of Object.assign(entity, body) without a proper allowlist of fields. This allowed an authenticated attacker to overwrite security-sensitive, server-managed properties, most notably workspaceId, by including them in the JSON request body.

By manipulating the workspaceId, an attacker could move an evaluator they control into any other workspace, breaking workspace isolation and leading to a cross-workspace data takeover. The vulnerability existed in multiple functions:

EvaluatorDTO.toEntity: This method directly contained the unsafe Object.assign call, making any function that used it (like createEvaluator and updateEvaluator) vulnerable.
createEvaluation: This function had its own instance of the same vulnerable Object.assign pattern.

The patch addresses this by introducing a stripProtectedFields utility function. This function removes a list of protected fields (id, workspaceId, createdDate, etc.) from the request body before Object.assign is called. Additionally, the code was updated to explicitly set the workspaceId from a trusted, server-side source rather than the request body, ensuring proper data isolation is maintained.

Vulnerable functions

EvaluatorDTO.toEntity

packages/server/src/Interface.Evaluation.ts

This static method was used to convert a request body into an `Evaluator` entity. It used `Object.assign` to copy all properties from the request body (`body`) into the new entity (`newDs`). This allowed an attacker to overwrite protected properties like `workspaceId` and `id` by simply including them in the request body, leading to a cross-workspace data takeover.

createEvaluation

packages/server/src/services/evaluations/index.ts

This function used `Object.assign` to copy properties from the request body into a new `Evaluation` entity. This allowed an attacker to control server-managed fields, such as `workspaceId`. The patch mitigates this by first stripping protected fields from the body before the assignment and then explicitly setting the `workspaceId` from a trusted source, preventing unauthorized modifications.

createEvaluator

packages/server/src/services/evaluator/index.ts

This function is responsible for creating a new evaluator. It was vulnerable because it used the `EvaluatorDTO.toEntity` method, which performed an unsafe mass assignment from the request body. An attacker could provide a malicious `workspaceId` in the request body to assign the new evaluator to a different workspace. The fix in `toEntity` prevents this.

updateEvaluator

packages/server/src/services/evaluator/index.ts

This function is responsible for updating an existing evaluator. It was vulnerable because it used the `EvaluatorDTO.toEntity` method, which performed an unsafe mass assignment. An attacker could update an evaluator they own and change its `workspaceId` to move it to another workspace, effectively taking it over. The fix in `toEntity` prevents this, and the `workspaceId` is now explicitly set from a trusted parameter.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.