npm/flowise CVE-2026-41277: high 8.8, EPSS 0.48%

Flowise: Mass Assignment in DocumentStore Create Endpoint Leads to Cross-Workspace Object Takeover (IDOR)

Action: Upgrade flowise to 3.1.0 or later.

npm i flowise@3.1.0

Affected

Fixed versions

Sources

• osv: GHSA-3prp-9gf7-4rxx
• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-3prp-9gf7-4rxx
• https://nvd.nist.gov/vuln/detail/CVE-2026-41277
• https://github.com/FlowiseAI/Flowise

CVE-2026-41277 · published 2026-04-17T21:34:16Z · modified 2026-05-05T16:11:32.504356Z · JSON