CVE-2026-91929 describes a missing authorization vulnerability in FlowiseAI's Flowise product affecting versions prior to 3.1.4. The flaw exists in Enterprise endpoints where resource ownership is not properly verified before allowing operations. As a result, attackers with some level of Enterprise access can carry out unauthorized actions including deleting arbitrary workspaces, self-inviting into other organizations, modifying cross-organization roles, and abusing stored Single Sign-On (SSO) secrets. The vulnerability has a CVSS 3.1 score of 7.1, indicating high severity, with network attack vector, high complexity, low privileges required, no user interaction, and high impact on confidentiality and integrity, and low impact on availability.

Successful exploitation can lead to unauthorized deletion of workspaces, unauthorized access to other organizations by self-invitation, unauthorized modification of roles across organizations, and abuse of stored SSO secrets. This compromises confidentiality and integrity of organizational data and access controls, potentially leading to significant operational disruption and data exposure.

A fix is available in Flowise version 3.1.4. Users should upgrade to version 3.1.4 or later to remediate this authorization vulnerability. No additional mitigation steps are indicated in the provided data.