CVE-2026-91937

HIGHCVSS 7.5

Description

Flowise before 3.1.4 fails to sanitize the overrideConfig.sessionId parameter before using it in MongoDB queries within the MongoDBMemory node. Unauthenticated attackers can submit MongoDB operator objects through the prediction API to read chat history records belonging to other users from the shared collection.

Timeline

Published:September 15th, 2026 4:17 PM

Last modified:September 23rd, 2026 5:17 PM

CVSS Scoring

CVSS v3: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-943

References & Reports

Advisories, patches, and third-party reports

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wpvf-4vfx-rgxm
https://www.vulncheck.com/advisories/flowise-before-3.1.4-nosql-injection-via-sessionid

Source: NIST NVD · Data may lag official sources by up to one minute