The flaw lies in an endpoint that updates a chatflow object. Clients can send data that changes server‑controlled attributes such as deployed, isPublic, workspaceId, createdDate, and updatedDate. Because the server does not validate these values, an attacker who is logged into the system can move a chatflow from one workspace to another and alter its deployment status or visibility settings. The result is an unauthorized shift of resources across workspaces and the ability to make a chatflow public or private without proper authorization.

The vulnerability is present in FlowiseAI’s Flowise application prior to version 3.1.2. Any installation of Flowise using a version older than 3.1.2 that exposes the chatflow update API to authenticated users is susceptible. The fix is applied in release 3.1.2, so versions 3.0.x through 3.1.1 are affected.

The CVSS base score is 7.6, indicating a high‑severity problem that can be exploited by an authenticated user who has access to the API. The EPSS score is not available, but the lack of server‑side validation and authorization means that the attack is straightforward once the user has credentials. The vulnerability is not listed in CISA KEV, so no known active exploitation campaigns have been reported in the public record. Attackers can achieve this by sending a crafted update request that includes prohibited fields, which the server will apply without further checks. The effect is to move resources between workspaces and toggle public/private status, potentially exposing sensitive data or disrupting workflow isolation.