Flowise Cloud Improper Mass Assignment Vulnerability (CVE-2026-41267)
Overview
Flowise Cloud versions prior to 3.1.0 are susceptible to an improper mass assignment vulnerability within the account registration endpoint. This flaw allows unauthenticated attackers to exploit the system by injecting malicious data into server-managed fields during the account creation process. The core issue lies in insufficient validation of user-provided data, enabling attackers to bypass intended field restrictions and inject arbitrary nested objects. This manipulation can compromise critical ownership metadata, creation and update timestamps, organization associations, and user role mappings. In multi-tenant deployments, this can lead to unauthorized access, privilege escalation, and a complete breach of trust boundaries, potentially allowing an attacker to impersonate other users or gain administrative control over shared resources. The vulnerability is critical as it can be exploited without any prior authentication.
Affected Systems
Testing Guide
1. Attempt to register a new account using a modified payload that includes unexpected JSON fields (e.g., attempting to set an 'isAdmin' flag or assign an existing organization ID). 2. Verify if the system allows these injected fields to be processed and persisted. 3. If the system prevents the injection or rejects the payload, it is likely patched or not affected.
Mitigation Steps
1. **Upgrade Flowise Cloud:** Update to version 3.1.0 or later. 2. **Input Validation:** Implement strict server-side validation for all incoming data, especially during account creation, to ensure only permitted fields are accepted. 3. **Least Privilege:** Ensure that newly registered accounts are assigned the minimum necessary privileges by default. 4. **Auditing:** Regularly audit user registration and account modification logs for suspicious activity.
Patch Details
Version 3.1.0