A weakness in FlowiseAI Flowise up to version 3.0.12 allows an attacker to manipulate request arguments such as userId, organizationId, workspaceId, or email within the User Controller component. This manipulation bypasses intended authorization controls, potentially enabling unauthorized access to sensitive data or elevated privileges. The flaw reflects classic access control weaknesses covered by CWE-285 and CWE-639.

The vulnerability affects FlowiseAI’s Flowise server software, specifically all releases up to and including 3.0.12. Users operating any of these versions are susceptible to the authorization bypass described.

The CVSS base score of 5.3 indicates moderate severity, and the EPSS score is not available, so the availability of ready‑to‑use exploits is unclear. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been reported. The attack vector appears to be remote, inferred from the phrase “The attack may be initiated remotely,” meaning the attacker can trigger the flaw over the network by sending crafted requests, although explicit prerequisites are not detailed.