Flowise, a user‑friendly interface for building large language model pipelines, contains a mass‑assignment flaw in its CustomTemplate create and update functions. The bug allows a user to set fields that should be restricted, enabling them to modify or replace templates belonging to other workspaces.

All installations of FlowiseAI:Flowise earlier than version 3.1.2 are affected. The issue was documented and corrected in the 3.1.2 release, and any variant that has not been upgraded remains vulnerable.

The CVSS score of 7.7 places the flaw in the high‑severity range. No EPSS value is available and the vulnerability is not listed in CISA’s KEV catalog. An attacker who has legitimate access to any workspace can exploit the flaw by sending a creation or update request that assigns fields belonging to a different workspace, thus taking over that workspace’s template.