Flowise’s variable update endpoint lets authenticated users modify server‑controlled fields such as workspaceId, createdDate, and updatedDate, creating a mass assignment flaw. The weakness is exemplified by CWE-284 (Broken Access Control), CWE-639 (Privilege Escalation), and CWE‑915 (Mass Assignment). An attacker who can authenticate to the system can set the workspaceId to another workspace, reassigning variables across workspaces and violating tenant isolation, potentially exposing sensitive data.

The vulnerability affects FlowiseAI’s Flowise platform in all deployments running versions earlier than 3.1.2; no other products or vendors are listed as impacted.

The CVSS score of 7.6 signals high severity, and although EPSS data is unavailable, the lack of server‑side validation makes the exploit straightforward. The issue is not included in the CISA KEV catalog. An attacker only needs normal authenticated access to send an update request containing a crafted workspaceId, thereby moving a variable to an arbitrary workspace without additional privileges.