CVE-2026-30822CWE-915

Flowise: Mass Assignment in `/api/v1/leads` Endpoint

High · published March 7, 2026

CVSS v3.0
7.7
EPSS
1%
Percentile
42.8
In the wild
Unconfirmed
What it is

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, unauthenticated users can inject arbitrary values into internal database fields when creating leads. This issue has been patched in version 3.0.13.

The record
Technical detail
CVSS v3.0
7.7 · HIGH
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00512 · 42.8th percentile
Weakness
CWE-915 · Improperly Controlled Modification of Dynamically-Determined Object Attributes
Published
2026-03-07T05:08Z
EPSS history
Timeline
  • 25 SEP 03:25Z
    EPSS moved 13% → 0%
    epss
  • 07 MAR 05:08Z
    Flowise: Mass Assignment in `/api/v1/leads` Endpoint
    cvelistv5