CVE-2026-91929

Executive Summary

CVE-2026-91929 is a broken access control vulnerability (CWE-862, Missing Authorization) affecting Flowise, an open-source low-code LLM application builder, in versions prior to 3.1.4. Enterprise endpoints fail to verify resource ownership before performing operations, allowing a user with Enterprise-level access to manipulate resources belonging to other tenants. The impact is high for both confidentiality and integrity (CVSS 7.1), enabling cross-tenant workspace deletion, unauthorized organization membership, cross-organization role modification, and abuse of stored SSO secrets.

Technical Analysis

The vulnerability resides in Flowise's Enterprise-tier endpoints, which are responsible for multi-tenant management operations. According to the NVD description, these endpoints "fail to verify resource ownership before operations." This is a textbook missing authorization flaw: while the endpoints presumably authenticate the caller (i.e., the requester has valid Enterprise credentials), they do not perform an ownership or tenancy check that binds the requested resource to the authenticated principal's organization.

The CVSS vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L indicates:

• AV:N (Network): Exploitable remotely over the network.
• AC:H (High): Requires conditions beyond the attacker's control — consistent with the need for Enterprise access and knowledge of target resource identifiers (e.g., workspace, organization, or user IDs).
• PR:L (Low Privileges): The attacker needs a valid authenticated account with Enterprise access, but no administrative role.
• UI:N (No User Interaction): No victim action required.
• S:U (Unchanged): The vulnerability does not cross trust boundaries at the security-scope level per CVSS semantics.
• C:H / I:H: Full disclosure and modification of cross-tenant data is possible — workspaces, organization memberships, roles, and SSO secrets.
• A:L: Limited availability impact, consistent with the ability to delete workspaces but not to crash the entire platform.

The multi-tenant nature of Flowise Enterprise deployments is central to the threat model. In such deployments, multiple organizations share a single instance, and the security boundary between tenants is enforced by ownership checks. Because those checks are absent, a low-privileged Enterprise user can operate on resources that belong to a different organization.

The explicit mention of "abuse stored SSO secrets" is significant: SSO configuration material (client secrets, signing certificates, or related credentials) stored per-organization could be read or manipulated, potentially enabling broader identity-provider compromise depending on how those secrets are used. Note that the NVD description does not name specific API routes, function names, or parameter schemas, so the exact request format is not specified in the available intelligence. The attack surface consists of the Enterprise management API endpoints and any administrative interface (UI or API) used to manage workspaces, organization membership, roles, and SSO configuration.

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code is available for CVE-2026-91929. The attack chain below is inferred strictly from the vulnerability class (CWE-862) and the behaviors enumerated in the NVD description. No specific endpoints, function names, or parameters are fabricated; where the description is silent, the mechanism is described at the vulnerability-class level.

1) Reconnaissance / Target Identification The attacker identifies an internet-exposed Flowise Enterprise instance, or a shared instance within a multi-tenant environment, to which they have legitimate access. Reconnaissance includes enumerating which workspaces, organizations, roles, and SSO configurations exist and obtaining their identifiers. Because the CVSS vector specifies AC:H, the attacker likely needs to know or discover target resource identifiers for cross-tenant operations. Shodan-style reconnaissance (e.g., http.title:"Flowise") can locate exposed instances.

2) Triggering the Flaw Class The attacker authenticates with a valid Enterprise-level account. They then submit requests to Enterprise management endpoints that act on resources belonging to a different organization. Because the endpoints "fail to verify resource ownership before operations," the requests are processed without confirming that the caller's organization owns the targeted resource. This is the core missing-authorization condition.

3) Payload / Execution Method At the vulnerability-class level, the attacker issues crafted requests — likely directly against the management API or via the administrative interface — specifying resource identifiers belonging to another tenant. Based on the NVD description, the observable outcomes are:

• Deletion of arbitrary workspaces belonging to other tenants.
• Invitation of the attacker's own account into other organizations.
• Modification of user roles across organizations.
• Retrieval or abuse of stored SSO secrets.

No specific request payload, endpoint path, or parameter name is available in the provided intelligence; these would need to be confirmed against the vendor's advisory or source code.

4) Post-Exploitation Impact Successful exploitation allows cross-tenant manipulation of Flowise resources. The attacker can destroy victim workspaces (availability/integrity impact), insert themselves into victim organizations (persistence and lateral movement within the multi-tenant instance), escalate or alter roles across organizations (privilege escalation / integrity impact), and misuse stored SSO secrets (potential identity-provider abuse). The net effect is a breakdown of tenant isolation on the affected Flowise instance.

Impact Assessment

• Confidentiality (C:H): Cross-tenant access to workspaces, organization data, and stored SSO secrets. Exposure of SSO secrets may have downstream effects beyond the Flowise instance if those secrets are trusted by external identity providers.
• Integrity (I:H): Attackers can delete workspaces, alter organization memberships, and modify cross-organization roles, corrupting tenant configurations and access control state.
• Availability (A:L): Deletion of workspaces can disrupt tenant operations, but the vector indicates limited platform-wide availability impact.
• Business impact: Multi-tenant Flowise Enterprise deployments are the primary blast radius. Tenants hosting sensitive LLM applications, proprietary prompt data, or identity integrations face data loss, unauthorized access, and potential downstream identity compromise. Regulatory and contractual concerns (tenant isolation guarantees) are material.
• Exploitability: PR:L/AC:H with no known public exploit reduces immediate mass-exploitation risk, but the vulnerability is remotely triggerable and requires no user interaction. EPSS is 0.00328 (25.9th percentile), indicating low current exploitation likelihood. Not listed in CISA KEV.

Detection Guidance

Sigma Rule

title: Flowise Cross-Tenant Authorization Bypass Attempt (CVE-2026-91929)
id: 7c1e9a52-4b3f-4d9e-9c21-9f0a1e2b3c4d
status: experimental
description: Detects Flowise Enterprise API requests targeting workspaces, organizations, roles, or SSO configuration that may indicate missing ownership checks.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91929
author: Threat Intelligence Team
date: 2026-01-01
logsource:
  category: webserver
  product: flowise
detection:
  selection_method:
    cs-method:
      - 'DELETE'
      - 'PUT'
      - 'PATCH'
      - 'POST'
  selection_path:
    cs-uri-stem|contains:
      - '/workspace'
      - '/organization'
      - '/role'
      - '/sso'
  condition: selection_method and selection_path
falsepositives:
  - Legitimate administrative operations by organization owners
level: medium
tags:
  - attack.t1190
  - cve.2026.91929

YARA Rule

rule CVE_2026_91929_Flowise_CrossTenant_IDs
{
    meta:
        description = "Detection aid for CVE-2026-91929 (Flowise cross-tenant authorization bypass) in request/response logs"
        author = "Threat Intelligence Team"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91929"
        date = "2026-01-01"
        cve = "CVE-2026-91929"
    strings:
        $p1 = "/workspace" ascii nocase
        $p2 = "/organization" ascii nocase
        $p3 = "/role" ascii nocase
        $p4 = "/sso" ascii nocase
        $m1 = "DELETE" ascii
        $m2 = "organizationId" ascii nocase
    condition:
        uint32(0) != 0x7B5C7274 and
        (any of ($p1, $p2, $p3, $p4)) and
        (any of ($m1, $m2)) and filesize < 200KB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91929 Possible Flowise Cross-Tenant Authorization Bypass"; flow:established,to_server; http.method; content:"DELETE"; http.uri; content:"/workspace"; nocase; http.uri; content:"/organization"; nocase; clamp:alert; sid:202691929; rev:1; metadata:created_at 2026_01_01, cve CVE_2026_91929; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91929;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where network.protocol == "http" and http.request.method == "POST" and url.path : ("*workspace*" or "*organization*" or "*sso*") ]
  [ network where network.protocol == "http" and http.request.method in ("DELETE", "PUT", "PATCH") and url.path : ("*workspace*" or "*organization*" or "*role*") ]

Splunk SPL Query

index=web sourcetype=flowise OR sourcetype=access_combined
| eval m=upper(cs_method)
| where m IN ("DELETE","PUT","PATCH","POST")
| where match(cs_uri_path, "(?i)/(workspace|organization|role|sso)")
| stats count values(cs_uri_path) as paths by src_ip, user
| where count >= 3

Wazuh OSSEC Rule

<group name="flowise,cve-2026-91929,">
  <rule id="2026919" level="8">
    <decoded_as>json</decoded_as>
    <field name="method">DELETE|PUT|PATCH|POST</field>
    <regex type="pcre2">(?i)/(workspace|organization|role|sso)</regex>
    <description>CVE-2026-91929: Possible Flowise cross-tenant authorization bypass request</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>access_control,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source (OSV) claims a patch in 3.1.4; not independently confirmed by vendor advisory or second source). No vendor fix text or workarounds are available in the provided data.

1. Immediate mitigations

   • Restrict network access to the Flowise Enterprise administrative interface and management API to trusted networks/VPN; do not expose them directly to the internet.
   • Enforce strongest authentication and least privilege across all Enterprise accounts; audit and remove accounts with access broader than their role requires.
   • If multi-tenancy is not strictly required, isolate tenants into separate Flowise instances to remove the shared authorization boundary.
   • Rotate any SSO client secrets and signing materials configured in Flowise Enterprise as a precaution, and monitor identity-provider logs for unexpected use.

2. Patch / upgrade steps

   • Upgrade Flowise to version 3.1.4 (or later) per the OSV-sourced claim. Because patch confidence is only 2/4, validate against the official Flowise release notes/advisory before relying on it.
   • Verify the fix is present via the vendor's release/changelog and re-test cross-tenant boundary behavior after upgrade.

3. Long-term hardening

   • Mandate server-side ownership checks for every resource operation in multi-tenant code paths, enforced centrally rather than per-endpoint.
   • Adopt automated authorization testing (e.g., cross-tenant regression tests) in CI/CD.
   • Perform regular tenant-isolation reviews and penetration tests focused on IDOR/broken access control (CWE-862).
   • Maintain an inventory of stored secrets (SSO and otherwise) with rotation policies and monitoring for anomalous use.

References

• NVD — CVE-2026-91929: https://nvd.nist.gov/vuln/detail/CVE-2026-91929
• OSV advisory (patch claim source): https://osv.dev/
• Flowise project (vendor): https://github.com/FlowiseAI/Flowise
• CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• CISA KEV Catalog (CVE-2026-91929 not listed as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Note on exploit activity: No public PoC, exploit code, Nuclei template, or threat-actor campaign is known for CVE-2026-91929 at the time of writing. EPSS is 0.00328 (25.9th percentile), and the CVE is not in CISA KEV. No exploit-in-the-wild evidence is available in the provided intelligence.