CVE-2026-91929: Flowise before 3.1.4 Cross-Tenant Authorization Bypass
Flowise versions before 3.1.4 contain cross-tenant authorization gaps in Enterprise endpoints that fail to verify resource ownership before operations. Attackers with Enterprise access can delete arbitrary workspaces, invite themselves into other organizations, modify cross-org roles, and abuse stored SSO secrets.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Flowiseto a version that resolves this vulnerability.Fixed in 3.1.4
Event History
Frequently Asked Questions
Who is exposed to this issue?
Organizations using Flowise Enterprise endpoints on versions before 3.1.4 are affected. Exploitation requires an attacker to have Enterprise access.
What access does an attacker need to exploit it?
The attacker needs low-privileged authenticated access to the Enterprise functionality. No user interaction is required, but exploitation has high attack complexity.
What could an attacker do after exploiting the authorization gaps?
An attacker could delete arbitrary workspaces, add themselves to other organizations, alter roles across organizations, and abuse stored SSO secrets. The issue can affect confidentiality and integrity and has a limited availability impact.
How can I remediate this issue?
Upgrade Flowise to version 3.1.4 or later. The affected range is versions before 3.1.4.