{
 "id": "AIR-2026-0587",
 "slug": "cve-2026-41277-flowise-mass-assignment-leads-to-cross-worksp",
 "title": "CVE-2026-41277: Flowise Mass Assignment Leads to Cross-Workspace Object Takeover",
 "summary": "A mass assignment flaw in Flowise allows authenticated users to manipulate primary keys during document store creation, leading to unauthorized object modification. Users are advised to update to the patched version.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Flowise"
 ],
 "incident_date": "2026-04-17",
 "incident_date_precision": "day",
 "first_reported": "2026-04-17",
 "sources": [
  {
   "url": "https://github.com/advisories/GHSA-3prp-9gf7-4rxx",
   "publisher": "GitHub Advisory Database",
   "title": "CVE-2026-41277: Flowise: Mass Assignment in DocumentStore Create Endpoint Leads to Cross-Workspace Object Takeover (IDOR)",
   "published_at": "2026-04-17"
  },
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41277",
   "publisher": "NVD",
   "title": "CVE-2026-41277: Flowise is a drag & drop user interface to build a customized large language model flow.",
   "published_at": "2026-04-23"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_ghsa",
 "tags": [
  "CVE-2026-41277",
  "idor",
  "flowise"
 ],
 "created_at": "2026-10-18T07:00:14.101Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}