{"id":"CVE-2026-46441","aliases":["GHSA-hp26-q66v-q2w7"],"url":"https://o3.security/vulnerability/CVE-2026-46441","summary":"Flowise: Mass Assignment in Assistant Update Endpoint Allows Cross-Workspace Resource Reassignment","details":"### Summary\nA Mass Assignment vulnerability exists in the assistant update endpoint of FlowiseAI.\n\nThe endpoint allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and updatedDate when updating an assistant resource.\n\nDue to missing server-side validation and authorization checks, an attacker can manipulate the workspaceId field and reassign assistants to arbitrary workspaces. This breaks tenant isolation in multi-workspace environments.\n\n### Details\nThe endpoint responsible for updating assistants:\n\n**PUT /api/v1/assistants/{assistantId}**\n\naccepts a JSON request body containing assistant metadata.\n\nHowever, the server does not restrict which properties may be modified by the client. As a result, user-controlled request bodies can include additional fields that should normally be controlled only by the backend.\n\nServer-controlled fields that can be manipulated include:\n\n1. workspaceId\n2. createdDate\n3. updatedDate\n\nThese fields appear to be directly mapped to the underlying database entity without strict DTO whitelisting or authorization checks.\n\nFor example, the following request body was accepted:\n\n```json\n{\n  \"details\": \"\",\n  \"credential\": \"11ca7fef-c9b1-4c87-aa54-e547aed8a249\",\n  \"iconSrc\": null,\n  \"type\": \"CUSTOM\",\n  \"createdDate\": \"2026-03-06T17:31:04.000Z\",\n  \"updatedDate\": \"2026-03-06T17:31:55.000Z\",\n  \"workspaceId\": \"11111111-2222-3333-4444-555555555555\"\n}\n```\n\nThis indicates that internal, server-controlled properties can be modified by an authenticated user.\n\n### PoC\n\n1. Authenticate to the Flowise interface.\n2. Capture the request used to update an assistant:\n\n```http\nPUT /api/v1/assistants/<ASSISTANT_ID>\nContent-Type: application/json\n\nModify the request body by injecting server-controlled fields:\n\n{\n  \"details\": \"\",\n  \"credential\": \"11ca7fef-c9b1-4c87-aa54-e547aed8a249\",\n  \"iconSrc\": null,\n  \"type\": \"CUSTOM\",\n  \"createdDate\": \"2026-03-06T17:31:04.000Z\",\n  \"updatedDate\": \"2026-03-06T17:31:55.000Z\",\n  \"workspaceId\": \"11111111-2222-3333-4444-555555555555\"\n}\n\n```\n3.Send the request.\n\nObserve that the response accepts and persists the attacker-controlled workspaceId and metadata fields.\n\n### Impact\nThis vulnerability allows authenticated users to manipulate internal attributes of assistant resources.\n\nConfirmed impacts include:\n\n- Cross-workspace reassignment of assistants (workspaceId)\n- Unauthorized modification of metadata (createdDate, updatedDate)\n\nIn multi-tenant deployments, this may allow an attacker to move assistants between workspaces without authorization, breaking tenant isolation boundaries.","published":"2026-06-08T15:30:36.357Z","modified":"2026-08-12T03:51:29.735741268Z","cvss":null,"epss":{"score":0.00274,"percentile":0.19213,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"flowise","fixedVersion":"3.1.2"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.1.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46441.json"},{"type":"ADVISORY","url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-hp26-q66v-q2w7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46441"},{"type":"PACKAGE","url":"https://github.com/FlowiseAI/Flowise"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:29.735741268Z"}}