An improper mass assignment vulnerability in the Flowise Cloud account registration endpoint lets unauthenticated attackers inject server‐managed fields and nested objects during account creation. By supplying crafted JSON, the attacker can manipulate ownership metadata, timestamps, organization association, and role mappings, thereby breaking trust boundaries in a multi‑tenant environment and enabling unauthorized access to other organizations' resources.

All versions of Flowise prior to 3.1.0 released by FlowiseAI are affected. The flaw is present in the account registration feature used to create new user accounts for the Flowise Cloud service.

The CVSS score of 8.1 classifies this flaw as high severity, while the EPSS score of less than 1 % indicates a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by sending a malicious payload to the registration endpoint without authentication, establishing an account that is improperly linked to an organization or granted elevated role mappings.