Flowise’s public prediction endpoint accepted an overrideConfig object from unauthenticated users and merged it directly into internal configuration structures without verification. This flaw allowed attackers to inject arbitrary properties into the flow execution context, overwrite critical identifiers such as chatId and sessionId, and manipulate template variables resolved by flow nodes. The result is the potential to alter or hijack the behavior of any public chatflow, which can lead to unauthorized code execution or data disclosure within the Flowise instance.

Vulnerable installations are those running Flowise before version 3.1.3. The impact applies to any public chatflows exposed through the POST /api/v1/prediction/:id endpoint. Administrators should review all running environments and ensure they are not using a pre‑3.1.3 release.

The CVSS score of 8.8 marks this as a high severity vulnerability. With no EPSS score available, the exploitation probability is unknown but the lack of authentication on the affected endpoint makes exploitation likely. The vulnerability is not listed in the CISA KEV catalog and no official workaround exists; the only mitigations are the vendor’s patch and access controls. Attackers can use the flaw to manipulate flow execution, potentially leading to remote code execution depending on the node logic. The absence of an authentication guard indicates a direct attack vector via an unauthenticated POST request.