CVE-2026-91937CWE-943

CVE-2026-91937

High · published September 15, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
39.7
In the wild
Unconfirmed
What it is

Flowise before 3.1.4 fails to sanitize the overrideConfig.sessionId parameter before using it in MongoDB queries within the MongoDBMemory node. Unauthenticated attackers can submit MongoDB operator objects through the prediction API to read chat history records belonging to other users from the shared collection.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00470 · 39.7th percentile
Weakness
CWE-943 · Improper Neutralization of Special Elements in Data Query Logic
Published
2026-09-15T20:17Z
References (2)
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wpvf-4vfx-rgxm · [email protected]https://www.vulncheck.com/advisories/flowise-before-3.1.4-nosql-injection-via-sessionid · [email protected]
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 15 SEP 15:17Z
    Flowise before 3.1.4 NoSQL Injection via sessionId
    cvelistv5