Skip to content
Threat Feed
Subscribe

Tag

Tenant Isolation

3 briefs RSS
high advisory

Flowise Cross-Tenant Authorization Vulnerability

Flowise versions before 3.1.4 contain authorization gaps in Enterprise endpoints that allow authenticated users to perform cross-tenant operations including unauthorized workspace deletion and SSO credential access.

Flowise Enterprise +1 path-traversal arbitrary-file-write rce xss vulnerability nosql-injection web-application ssrf +3
4t 1c
high advisory

FlowiseAI Mass Assignment in Assistant Update Endpoint Allows Cross-Workspace Resource Reassignment

FlowiseAI version 3.1.1 and earlier contains a mass assignment vulnerability in the assistant update endpoint, allowing authenticated users to modify server-controlled properties like workspaceId, createdDate, and updatedDate, enabling cross-workspace reassignment of assistants and breaking tenant isolation in multi-workspace environments.

FlowiseAI mass assignment tenant isolation web application
2r 1t
high advisory

FlowiseAI Mass Assignment Vulnerability in Variable Update Endpoint

FlowiseAI versions 3.1.1 and earlier contain a mass assignment vulnerability in the variable update endpoint allowing authenticated users to modify server-controlled properties like workspaceId, createdDate, and updatedDate, potentially breaking tenant isolation in multi-workspace environments (CVE-2026-42861).

flowise <= 3.1.1 mass assignment tenant isolation web application
2r