CVE-2026-91930
Received Received - Intake

Flowise Enterprise Tenant Isolation Bypass via Arbitrary Organization ID Injection

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulnCheck

Description
Flowise before 3.1.4 fails to scope enterprise organization and workspace membership APIs to the caller's tenant, allowing authenticated users to supply arbitrary organization IDs. Attackers can add themselves as organization owners, create workspaces, and gain administrative access to victim organizations by exploiting insufficient tenant isolation in the organizationuser and workspace endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91930
EUVD
EUVD-2026-78788

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
flowiseai flowise to 3.1.4 (exc)
flowise flowise to 3.1.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Flowise before version 3.1.4 has a tenant isolation flaw in its enterprise organization and workspace membership APIs. Authenticated users can bypass tenant restrictions by providing arbitrary organization IDs, allowing them to escalate privileges and gain unauthorized administrative access to other organizations.

Impact Analysis

If you are a user of Flowise, an attacker could exploit this to add themselves as an organization owner, create workspaces, and gain full administrative control over your organization without authorization. This could lead to data theft, service disruption, or unauthorized modifications.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection principles and HIPAA's security and privacy requirements. Organizations using Flowise may face compliance violations, legal penalties, and reputational damage due to insufficient access controls.

Mitigation Strategies

Immediately upgrade Flowise to version 3.1.4 or later to address the insufficient tenant isolation in organization and workspace APIs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91930. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart