CyberRota Analysis
AI-GeneratedFlowise versions prior to 3.1.4 are vulnerable due to insufficient tenant isolation in their organization and workspace membership APIs, allowing authenticated users to manipulate organization IDs. This flaw enables attackers to elevate their privileges by adding themselves as organization owners and creating workspaces, potentially leading to administrative access within victim organizations. Organizations using Flowise should prioritize patching to mitigate the risk of unauthorized access and data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Flowise before 3.1.4 fails to scope enterprise organization and workspace membership APIs to the caller's tenant, allowing authenticated users to supply arbitrary organization IDs. Attackers can add themselves as organization owners, create workspaces, and gain administrative access to victim organizations by exploiting insufficient tenant isolation in the organizationuser and workspace endpoints.