CyberRota Analysis
AI-GeneratedFlowise versions prior to 3.1.4 contain a vulnerability that allows unauthenticated attackers to exploit the overrideConfig.sessionId parameter, enabling them to execute unauthorized MongoDB queries. This flaw can lead to the exposure of chat history records from a shared collection, compromising user privacy. Organizations using affected versions of Flowise should prioritize patching to mitigate the risk of data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Flowise before 3.1.4 fails to sanitize the overrideConfig.sessionId parameter before using it in MongoDB queries within the MongoDBMemory node. Unauthenticated attackers can submit MongoDB operator objects through the prediction API to read chat history records belonging to other users from the shared collection.