Improperly Controlled Modification of Dynamically-Determined Object Attributes in Flowise - CVE-2026-56276
Published: May 18, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU131703
CSH Severity: Low
CVSS v4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-56276
CWE-ID: CWE-915
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to modify restricted user fields and bypass password change verification.
The vulnerability exists due to improperly controlled modification of dynamically-determined object attributes in the PUT /api/v1/user endpoint when handling authenticated profile update requests. A remote user can send a crafted request body containing a credential value to modify restricted user fields and bypass password change verification.
The issue is limited to modification of the authenticated user's own account because the controller checks that the supplied id matches the current user.
Affected software
Flowise
How to mitigate CVE-2026-56276
Install security update from vendor's website.
Flowise - update to 3.1.2