CVE-2026-46478 describes a vulnerability in FlowiseAI Flowise, a drag-and-drop interface for building customized large language model flows. In versions before 3.1.2, the DatasetRow create and update operations allow mass-assignment of attributes without proper control, enabling an attacker with limited privileges to modify or take over rows across different workspaces. This improper control of dynamically-determined object attributes is categorized as CWE-915. The vulnerability has been addressed and patched in version 3.1.2.

An attacker with low privileges can exploit this vulnerability to perform cross-workspace row takeover by abusing mass-assignment in DatasetRow create and update operations. This could lead to unauthorized modification or access to data belonging to other workspaces, potentially compromising data integrity and confidentiality within the affected Flowise instances.

Upgrade Flowise to version 3.1.2 or later, where this vulnerability has been patched. No other official remediation or temporary fixes are indicated. Patch status is confirmed by the vendor stating the fix in version 3.1.2.