Flowise Vulnerabilities: Cross Tenant Authorization Bypass and Admin Takeover

• •Flowise versions before 3.1.4 are vulnerable to critical security flaws.
• •The vulnerabilities include an authorization bypass and organization admin takeover.
• •Immediate patching is recommended to prevent potential data breaches.

Two critical vulnerabilities have been identified in Flowise versions prior to 3.1.4. The first, a cross-tenant authorization bypass, allows unauthorized access to tenant data. The second vulnerability enables an organization admin takeover, potentially compromising entire organizations. Both vulnerabilities affect users of Flowise, a platform used for data management and processing. No specific CVEs were mentioned in the articles. The vulnerabilities could lead to significant data breaches if exploited. Security professionals are advised to prioritize patching these vulnerabilities. Current status indicates that both vulnerabilities are disclosed but not confirmed to be actively exploited. Organizations using Flowise should take immediate action to secure their systems.