Improperly Controlled Modification of Dynamically-Determined Object Attributes in Flowise - CVE-2026-46478

Detailed vulnerability description

The vulnerability allows a remote user to modify dataset rows across workspace boundaries and disclose sensitive information.

The vulnerability exists due to improperly controlled modification of dynamically-determined object attributes in the DatasetRow create and update service in packages/server/src/services/dataset/index.ts when handling crafted API requests that mass-assign request body fields onto DatasetRow entities. A remote user can send a specially crafted request with a client-controlled workspaceId or datasetId to modify dataset rows across workspace boundaries and disclose sensitive information.

Exploitation requires an authenticated session with permission to edit the source dataset row, and workspace identifiers can be obtained from API responses.

How to mitigate CVE-2026-46478

Sources

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-7j65-65cr-6644
• https://github.com/FlowiseAI/Flowise/commit/840d2ae14d25230579a58aa4305f8506672a0a45