CVE-2026-91930

HIGHCVSS 7.5

Description

Flowise before 3.1.4 fails to scope enterprise organization and workspace membership APIs to the caller's tenant, allowing authenticated users to supply arbitrary organization IDs. Attackers can add themselves as organization owners, create workspaces, and gain administrative access to victim organizations by exploiting insufficient tenant isolation in the organizationuser and workspace endpoints.

Timeline

Published:September 15th, 2026 4:17 PM

Last modified:September 23rd, 2026 5:17 PM

CVSS Scoring

CVSS v3: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-266

References & Reports

Advisories, patches, and third-party reports

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-pprx-4prj-35mj
https://www.vulncheck.com/advisories/flowise-before-3.1.4-cross-tenant-organization-admin-takeover

Source: NIST NVD · Data may lag official sources by up to one minute