What’s Vulnerable › Vulnerabilities

CVE-2026-91930: Flowise before 3.1.4 Cross-Tenant Organization Admin Takeover

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-15 · updated 2026-09-23
• Weakness: CWE-266

Description

Flowise before 3.1.4 fails to scope enterprise organization and workspace membership APIs to the caller's tenant, allowing authenticated users to supply arbitrary organization IDs. Attackers can add themselves as organization owners, create workspaces, and gain administrative access to victim organizations by exploiting insufficient tenant isolation in the organizationuser and workspace endpoints.

Affected products

• FlowiseAI Flowise: before 3.1.4 — fixed in 3.1.4

How to fix

Upgrade to a fixed version: FlowiseAI Flowise 3.1.4. Check the vendor advisory for mitigations.

References

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-pprx-4prj-35mj
• https://www.vulncheck.com/advisories/flowise-before-3.1.4-cross-tenant-organization-admin-takeover

Get alerted when CVE-2026-91930 or the next vulnerability affects your stack