Is CVE-2026-91929 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-91929 being exploited in the wild.

How severe is CVE-2026-91929?

High severity, with a CVSS score of 7.1, published 15 September 2026.

Is there a fix for CVE-2026-91929?

A patch was published on 2026-09-15: Version 3.1.4 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-91929 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-91929?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-91929: Flowise cross-tenant authorization bypass in Enterprise endpoints

CVE-2026-91929 · Severity: high · CVSS 7.1 · Published 2026-09-15

Flowise is a platform for building AI workflows and assistants. Versions before 3.1.4 contain authorization gaps in Enterprise-tier features that allow authenticated users to perform unauthorized actions across tenant boundaries—including deleting other organizations' workspaces, modifying roles, inviting themselves to other organizations, and accessing stored SSO secrets belonging to other tenants. This can lead to data destruction, unauthorized access to customer information, and operational disruption across multiple customers in a multi-tenant deployment.

Quick answers

Is CVE-2026-91929 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-91929 being exploited in the wild.
How severe is CVE-2026-91929?: High severity, with a CVSS score of 7.1, published 15 September 2026.
Which products and versions are affected?: Flowise Flowise before 3.1.4.
Is there a fix for CVE-2026-91929?: A patch was published on 2026-09-15: Version 3.1.4 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-91929 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-91929?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a series of missing authorization checks (CWE-862) across five Enterprise endpoints that fail to verify resource ownership before performing operations. Affected endpoints include DELETE /api/v1/workspace/{id} (allows cross-tenant workspace deletion), POST /api/v1/account/invite (self-invitation to arbitrary workspaces), PUT/DELETE /api/v1/organizationuser (cross-org role modification), PUT /api/v1/role (modification of foreign org roles via id-only fetch), and POST /api/v1/loginmethod/test (reuse of encrypted SSO secrets from other orgs). All require Enterprise license activation or Enterprise platform mode; an attacker must be an authenticated user with Enterprise access on the target instance. The root cause is absence of organization/workspace ownership assertions before mutation, despite such checks existing elsewhere in the codebase. Patches are available in version 3.1.4.

Affected products

Flowise Flowise before 3.1.4

Timeline

2026-08-31: disclosed: GHSA-7x8x-vv46-4579 published on GitHub
2026-09-15: patched: Version 3.1.4 released with fix
2026-09-15: advisory: CVE-2026-91929 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.