Improperly Controlled Modification of Dynamically-Determined Object Attributes Affecting flowise package, versions <3.1.2

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the Object.assign process. An attacker can gain unauthorized access to and control over evaluation data across different workspaces by supplying crafted JSON bodies that overwrite ownership fields such as workspaceId or id during entity creation or update. This allows the attacker to move evaluations between workspaces, exposing sensitive data to unauthorized users and breaking workspace isolation. This is only exploitable if the attacker is an authenticated user with permission to update or create evaluations and can enumerate or guess valid workspace UUIDs.

• GitHub Advisory
• GitHub Commit
• GitHub PR
• GitHub Release