CVE-2026-91929: fallo de gravedad alta en FlowiseAI Flowise
Flowise before 3.1.4 Cross-Tenant Authorization Bypass
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.6epss 0.4%
Flowise versions before 3.1.4 contain cross-tenant authorization gaps in Enterprise endpoints that fail to verify resource ownership before operations. Attackers with Enterprise access can delete arbitrary workspaces, invite themselves into other organizations, modify cross-org roles, and abuse stored SSO secrets.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Productos afectados
FlowiseAI · FlowiseCVEs relacionadas — FlowiseAI Flowise
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-59528CRITICALFlowise has Remote Code Execution vulnerabilityEPSS 86.5%CVE-2025-58434CRITICALFlowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account TakeoverEPSS 82.6%CVE-2024-8181CRITICALFlowise Authentication BypassEPSS 45.1%CVE-2026-30824HIGHFlowise: Missing Authentication on NVIDIA NIM EndpointsEPSS 37.3%CVE-2026-46442CRITICALFlowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox EscapeEPSS 33.0%CVE-2026-41268HIGHFlowise: Flowise Parameter Override Bypass Remote Command ExecutionEPSS 17.4%