Executive brief
FlowiseAI is susceptible to a mass-assignment vulnerability in its CustomTemplate service, allowing authenticated users to transfer templates between workspaces.
Affected products
- FlowiseAI FlowiseAI
- npm flowise
Junglewise Threat Intelligence
FlowiseAI mass assignment in CustomTemplate service
Severity: high · CVSS 7.7 · Published 2026-05-14
Technologies: FlowiseAI, flowise (npm). Vendors: FlowiseAI, npm.
Related threats
- Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decr
- Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, allowing attackers to abuse priva
- Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-sou
- Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v1/oauth2-credential/
- Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, a prompt injection sent to a chatfl