CVE-2026-46480 is a CWE-915 vulnerability in FlowiseAI's Flowise product, a drag-and-drop interface for building customized large language model flows. The issue arises from improper control over modification of dynamically-determined object attributes during evaluator creation and update operations, enabling mass-assignment attacks that allow an attacker with limited privileges to take over evaluators across different workspaces. This vulnerability affects all versions prior to 3.1.2 and has been fixed in version 3.1.2. The CVSS 4.0 base score is 7.7, indicating a high severity with network attack vector, low attack complexity, and requiring privileges but no user interaction.

Successful exploitation of this vulnerability allows an attacker with some privileges to perform mass-assignment on evaluator objects, resulting in cross-workspace evaluator takeover. This could lead to unauthorized control or manipulation of evaluators in other workspaces, potentially compromising data integrity or confidentiality within those workspaces.

Upgrade Flowise to version 3.1.2 or later, where this vulnerability has been patched. There is no indication of alternative mitigations or temporary workarounds. Users should verify they are not running affected versions and apply the official update promptly.