Executive brief
FlowiseAI, an open-source tool for building LLM applications, contains a vulnerability that allows users to move data between different organizational workspaces. An authenticated user can modify evaluation records to change their ownership, effectively 'stealing' them from one workspace or injecting them into another. This can lead to the exposure of sensitive data, including captured AI prompts and model outputs, to unauthorized users.
Technical details
A mass-assignment vulnerability exists in `packages/server/src/services/evaluations/index.ts` due to the use of `Object.assign()` on the Evaluation entity without a field allowlist. The root cause is that the application fails to filter sensitive properties like `workspaceId` and `id` from the request body before persisting them to the database via TypeORM. An authenticated attacker can issue a `PUT` request to `/api/v1/evaluations/<id>` containing a target `workspaceId` to reassign the evaluation to a different workspace. This bypasses workspace isolation, allowing for unauthorized data access and modification. The issue was fixed in version 3.1.2 by implementing an explicit field allowlist.
Affected products
- FlowiseAI flowise <= 3.1.1
Timeline
- 2026-05-14: disclosed: Advisory published on GitHub
- 2026-05-14: patched: Fix released in version 3.1.2