FlowiseAI's Flowise, a drag-and-drop interface for building customized large language model flows, contained a vulnerability (CWE-915) in versions before 3.1.2. The issue arises from improper control over modification of dynamically-determined object attributes during DatasetRow creation and update via mass-assignment. This flaw allows an attacker with limited privileges to take over rows across different workspaces, potentially leading to unauthorized data access or modification. The vulnerability has been addressed in Flowise version 3.1.2.

Successful exploitation of this vulnerability could allow an attacker with limited privileges to perform cross-workspace row takeover, potentially compromising data integrity and confidentiality across workspace boundaries within the Flowise application. The CVSS 4.0 score of 7.7 reflects high impact on confidentiality, integrity, and availability with network attack vector and low attack complexity.

A fix for this vulnerability is available in Flowise version 3.1.2. Users and administrators should upgrade to version 3.1.2 or later to remediate this issue. No additional vendor advisory or cloud service patching information is provided, so applying the official update is the recommended mitigation.