CVE-2026-30822: Flowise Mass Assignment Vulnerability in Leads Endpoint

Background

Flowise is an open-source application designed to facilitate the creation and management of leads through its API. It allows users to interact with lead data, enabling functionalities such as lead creation, updates, and retrieval. The application is built using Node.js and TypeORM, which provides a robust structure for managing database interactions. However, a critical vulnerability has been identified in the leads creation endpoint, which allows unauthorized users to manipulate internal fields of the Lead entity.

Vulnerability Detail

The vulnerability arises from a Mass Assignment flaw in the '/api/v1/leads' endpoint, allowing any unauthenticated user to control internal entity fields such as 'id', 'createdDate', and 'chatId' by including them in the request body. This is due to the use of Object.assign() without proper input validation or field filtering, enabling attackers to bypass auto-generated fields and inject arbitrary values. The implications of this vulnerability include potential data integrity violations, audit trail manipulation, and the risk of ID collisions, which could lead to overwriting existing records.

npm install flowise@3.1.4

npm install flowise@3.0.13

Workaround

As a temporary workaround, you can manually filter the fields that are assigned to the Lead entity. Here’s an example of how to do this in the createLead function:

const createLead = async (body: Partial<ILead>) => {

try {

        const chatId = body.chatId ?? uuidv4();
        const newLead = new Lead();
        const allowedFields = ['chatflowid', 'name', 'email', 'phone'];
        for (const field of allowedFields) {
            if (body[field] !== undefined) {
                newLead[field] = body[field];
            }
        }
        newLead.chatId = chatId;
        const appServer = getRunningExpressApp();
        const lead = appServer.AppDataSource.getRepository(Lead).create(newLead);
        const dbResponse = await appServer.AppDataSource.getRepository(Lead).save(lead);
        return dbResponse;
    } catch (error) {
        throw new InternalFlowiseError(...);
    }
};

Conclusion

The Mass Assignment vulnerability in Flowise's leads endpoint poses significant risks to data integrity and security. It is crucial for users to update to the patched version and implement proper input validation to mitigate these risks.

See every vulnerability recorded for flowise →

FAQ