CVE-2026-30822

CVE-2026-30822 · Flowise: Mass Assignment in `/api/v1/leads` Endpoint

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, unauthenticated users can inject arbitrary values into internal database fields when creating leads. This issue has been patched in version 3.0.13.

CVSS 7.7 · High · EPSS 13.4% · Fix available

Published: 2026-03-07T05:08:55.583Z
Updated: 2026-03-09T20:44:24.747Z

Stack: node

Affected products and versions

flowise
Versions
- < 3.0.13: Affected
No fix published
flowise npm
Affected ranges
- SEMVER: < 3.0.13
Update to 3.0.13

Original sources

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-mq4r-h2gh-qv7x
https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.13
https://nvd.nist.gov/vuln/detail/CVE-2026-30822

Check your server →

CVE-2026-30822 · Flowise: Mass Assignment in `/api/v1/leads` Endpoint

Affected products and versions

flowise

flowise npm

Original sources