The assistant update endpoint in Flowise allows authenticated users to set properties that should be controlled by the server, such as workspaceId, createdDate, and updatedDate. Because these fields are not validated or authorized on the backend, an attacker can change the workspaceId value when updating an assistant. This enables the attacker to move an assistant into an arbitrary workspace, breaking tenant isolation in a multi‑workspace deployment. The flaw corresponds to improper authorization (CWE‑284), missing pre‑condition checks (CWE‑639), and improper handling of mutable objects (CWE‑915).

The flaw affects FlowiseAI's Flowise product. All versions released before 3.1.2—specifically Flowise 3.0.x and 3.1.0/3.1.1—are vulnerable. The update endpoint can be accessed by any authenticated user who has permission to modify assistants.

With a CVSS score of 7.6, the vulnerability presents a high risk to confidentiality and integrity in multi‑tenant deployments. The EPSS score is not available, but the lack of server‑side validation means an attacker who authenticates to the system can change the workspaceId field in an assistant update request. Because the endpoint accepts arbitrary values, an attacker can reassign an assistant to any workspace for which the user does not normally have access, effectively breaching tenant isolation. The vulnerability is not listed in CISA KEV, and there are no known public exploits, so the exploitation likelihood depends largely on an attacker’s ability to log in to the target instance.