FlowiseAI Flowise versions before 3.1.2 suffer from CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes. This flaw allows an attacker with limited privileges (low privileges with partial user interaction) to perform mass-assignment during assistant creation and update operations, enabling cross-workspace assistant takeover. The vulnerability is network exploitable without user interaction and results in high confidentiality, integrity, and availability impacts. The issue is resolved in Flowise version 3.1.2.

Successful exploitation allows an attacker to take over assistants across different workspaces, potentially leading to unauthorized access and control over assistant configurations and data. This compromises confidentiality, integrity, and availability of the affected system components. No known exploits in the wild have been reported to date.

Upgrade Flowise to version 3.1.2 or later, where this vulnerability has been patched. Since this is not a cloud service, remediation depends on applying the official update. Patch status is confirmed by the vendor advisory indicating the fix in version 3.1.2.