# CVE-2026-8027: A weakness has been identified in FlowiseAI Flowise up to 3.0.12. Affected by this vulnerability is an unknown…

Source: https://junglewise.ai/threats/cve-2026-8027-a-weakness-has-been-identified-in-flowiseai-flowise-up-to-3-0-12  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-06  
License: CC BY 4.0 with a link back

CVE-2026-8027 · Severity: medium · CVSS 4.3 · Published 2026-05-06

A weakness has been identified in FlowiseAI Flowise up to 3.0.12. Affected by this vulnerability is an unknown functionality of the component User Controller Handler. This manipulation of the argument userId/organizationId/workspaceId/email causes authorization bypass. The attack may be initiated remotely. The affected component should be upgraded.

Technologies: [FlowiseAI Flowise](https://junglewise.ai/threats/technologies/flowiseai-flowise). Vendors: [FlowiseAI](https://junglewise.ai/threats/vendors/flowiseai).

## Quick answers

**Is CVE-2026-8027 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8027 being exploited in the wild.

**How severe is CVE-2026-8027?** Medium severity, with a CVSS score of 4.3, published 6 May 2026.

**Which products and versions are affected?** FlowiseAI Flowise. The advisory does not name versions.

**Is there a fix for CVE-2026-8027?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-8027?** Check whether you run FlowiseAI Flowise. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- FlowiseAI Flowise

## Related threats

- [Flowise sandbox escape in custom function endpoint](https://junglewise.ai/threats/cve-2026-119978-flowise-through-3-1-4-contains-a-sandbox-escape-vulnerability)
- [Flowise credential lookup authorization bypass](https://junglewise.ai/threats/cve-2026-100609-flowise-npm-packages-flowise-and-flowise-components-through-3-1)
- [Flowise authentication bypass via email-only SSO matching](https://junglewise.ai/threats/cve-2026-100607-flowise-through-3-1-4-resolves-sso-and-local-password-users)
- [Flowise authentication bypass in SSO login path](https://junglewise.ai/threats/cve-2026-100606-flowise-through-3-1-4-enterprise-platform-mode-with-sso-enabled)
- [Flowise missing authorization checks on chat message routes](https://junglewise.ai/threats/cve-2026-100605-flowise-through-3-1-4-contains-missing-route-level-rbac-checks)