Vulnerability · Published Sep 15, 2026 · Assigned by VulnCheck

CVE-2026-91930Flowise before 3.1.4 Cross-Tenant Organization Admin Takeover

High 7.5

In plain English

A high-severity security flaw in Flowise from FlowiseAI. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.4%top 65.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Flowise before 3.1.4 fails to scope enterprise organization and workspace membership APIs to the caller's tenant, allowing authenticated users to supply arbitrary organization IDs. Attackers can add themselves as organization owners, create workspaces, and gain administrative access to victim organizations by exploiting insufficient tenant isolation in the organizationuser and workspace endpoints.

Affected products (as reported)

Vendor	Product	Versions
FlowiseAI	Flowise	0 – before 3.1.4

Weakness: CWE-266 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-pprx-4prj-35mj) vendor-advisory
VulnCheck Advisory: Flowise before 3.1.4 Cross-Tenant Organization Admin Takeover third-party-advisory