CVE-2026-91929: Flowiseai Flowise

High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days.

Flowise versions before 3.1.4 contain cross-tenant authorization gaps in Enterprise endpoints that fail to verify resource ownership before operations. Attackers with Enterprise access can delete arbitrary workspaces, invite themselves into other organizations, modify cross-org roles, and abuse stored SSO secrets.

Affected products

• Flowiseai Flowise: before 3.1.4 (fixed in 3.1.4)

Published 2026-09-15. Last modified 2026-09-23.