CVE-2026-41267 is an authorization bypass vulnerability in FlowiseAI's Flowise product before version 3.1.0. It arises from improper mass assignment in the account registration endpoint, enabling unauthenticated attackers to inject and control server-managed fields and nested objects during account creation. This allows manipulation of critical metadata and role mappings, violating trust boundaries in multi-tenant deployments. The vulnerability is tracked under CWE-639 (Authorization Bypass Through User-Controlled Key) and CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes). The CVSS v3.1 base score is 8.1, indicating high severity. The issue is resolved in Flowise version 3.1.0.

Successful exploitation allows unauthenticated attackers to bypass authorization controls by injecting server-managed fields during account registration. This can lead to unauthorized modification of ownership metadata, timestamps, organization associations, and role mappings, potentially compromising multi-tenant isolation and enabling privilege escalation or data access violations. The impact includes full confidentiality, integrity, and availability compromise as indicated by the CVSS vector.

Upgrade Flowise to version 3.1.0 or later, where this vulnerability is fixed. Since the vendor advisory confirms the fix in 3.1.0, applying this official update is the recommended remediation. Patch status is not explicitly stated beyond this version fix, so verify with the vendor for any additional guidance or patches.