This vulnerability affects FlowiseAI Flowise up to version 3.0.12 in the User Controller Handler component. By manipulating arguments such as userId, organizationId, workspaceId, or email, an attacker can bypass authorization mechanisms remotely. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. No official remediation level or patch information is provided, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation allows an attacker to bypass authorization controls, potentially gaining unauthorized access to resources or actions within the affected FlowiseAI Flowise application. The impact is rated medium severity with limited impact on confidentiality, integrity, and availability as per the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently documented, users should monitor FlowiseAI's advisories for updates and plan to upgrade affected versions once a patch is released. Until then, restricting access to trusted users and environments may reduce exposure.