Flowise: Mass Assignment in `/api/v1/leads` Endpoint (FlowiseAI Flowise)
At a glance
- Source
- NVD
- EPSS
- EPSS 13.43 % · percentile 96 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Analyzed
Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, unauthenticated users can inject arbitrary values into internal database fields when creating leads. This issue has been patched in version 3.0.13.
Weaknesses (CWE)
- CWE-915 — Improperly Controlled Modification of Dynamically-Determined Object Attributes
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | HIGH 7.7 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L | GitHub_M |
| CVSS 3.0 | HIGH 7.7 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L | NVD · security-advisories@github.com (Secondary) |
Advisories
- GHSA-mq4r-h2gh-qv7x — Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint
European references
- ENISA EUVD · EUVD-2026-10109
- GCVE · GCVE-0-2026-30822
Affected configurations (NVD CPE)
cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*< 3.0.13
Affected products
| Product | Versions |
|---|---|
| FlowiseAI · Flowise | affected < 3.0.13 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |