Описание
Flowise versions before 3.1.4 contain cross-tenant authorization gaps in Enterprise endpoints that fail to verify resource ownership before operations. Attackers with Enterprise access can delete arbitrary workspaces, invite themselves into other organizations, modify cross-org roles, and abuse stored SSO secrets.
EPSS
Процентиль: 26%
0.00328
Низкий
7.1 High
CVSS3
Дефекты
CWE-862
Связанные уязвимости
CVSS3: 7.1
github
3 дня назад
Flowise versions before 3.1.4 contain cross-tenant authorization gaps in Enterprise endpoints that fail to verify resource ownership before operations. Attackers with Enterprise access can delete arbitrary workspaces, invite themselves into other organizations, modify cross-org roles, and abuse stored SSO secrets.
EPSS
Процентиль: 26%
0.00328
Низкий
7.1 High
CVSS3
Дефекты
CWE-862