{"id":"EUVD-2026-25284","enisaUuid":"a923b805-9b69-3d5b-9fad-a94dcd2ded5c","description":"Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to 3.1.0, an improper mass assignment (JSON injection) vulnerability in the account registration endpoint of Flowise Cloud allows unauthenticated attackers to inject server-managed fields and nested objects during account creation. This enables client-controlled manipulation of ownership metadata, timestamps, organization association, and role mappings, breaking trust boundaries in a multi-tenant environment. This vulnerability is fixed in 3.1.0.","datePublished":"Apr 23, 2026, 7:12:26 PM","dateUpdated":"Apr 23, 2026, 7:44:53 PM","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-48m6-ch88-55mj\n","aliases":"CVE-2026-41267\n","assigner":"GitHub_M","epss":0.33,"enisaIdProduct":[{"id":"c36fc33e-8159-368a-a2c8-98d289f52d00","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"\u003c 3.1.0"}],"enisaIdVendor":[{"id":"2cfda4ec-ef28-3c7c-8588-a8f026aaefc9","vendor":{"name":"FlowiseAI"}}],"enisaIdVulnerability":[{"id":"bc2aabdc-54c6-3fe7-9443-ba95956de098","vulnerability":{"id":"CVE-2026-41267","description":"Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to 3.1.0, an improper mass assignment (JSON injection) vulnerability in the account registration endpoint of Flowise Cloud allows unauthenticated attackers to inject server-managed fields and nested objects during account creation. This enables client-controlled manipulation of ownership metadata, timestamps, organization association, and role mappings, breaking trust boundaries in a multi-tenant environment. This vulnerability is fixed in 3.1.0.","datePublished":"Apr 23, 2026, 7:12:26 PM","dateUpdated":"Apr 23, 2026, 7:44:53 PM","status":"PUBLISHED","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-48m6-ch88-55mj\n","enisa_id":"EUVD-2026-25284\n","assigner":"GitHub_M","epss":0.33,"dataProcessed":"Oct 27, 2026, 7:17:29 AM","vulnerabilityProduct":[{"id":"a686dce6-ec29-37d6-9bb9-d360ddb49524","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"\u003c 3.1.0"}],"vulnerabilityVendor":[{"id":"dd7de7fc-e0de-3cd2-a591-c2947a5b780b","vendor":{"name":"FlowiseAI"}}]}}],"enisaIdAdvisory":[]}