Flowise is a drag‑and‑drop interface for building large‑language‑model flows. A mass‑assignment vulnerability in the create and update procedures for evaluations allows an attacker who can perform these actions to set or modify attributes that belong to a different workspace, effectively permitting takeover of evaluations across workspaces. This flaw is a case of Improper Authorization (CWE‑915).

Flowise, the FlowiseAI drag‑and‑drop interface for building LLM flows, is affected in all releases prior to 3.1.2. The vulnerability is fixed in version 3.1.2 and later.

The CVSS score of 7.7 points to a high severity. EPSS is not available, and the vulnerability is not in CISA’s KEV catalog. The flaw requires an attacker to have access to the Flowise web interface and the ability to create or update evaluations. An attacker with such access could use the flaw to transfer control of evaluations from one workspace to another. No exploitation details beyond those indicated are stated.