CVE-2026-91930: Flowise: cross-tenant org admin takeover via IDOR

HIGHPoC AVAILABLECISA: ATTEND

Published September 15, 2026

CISO Take

Flowise before 3.1.4 does not scope its enterprise organization and workspace membership APIs to the caller's tenant. Any authenticated low-privilege user can supply an arbitrary organization ID and add themselves as owner of a victim organization, then create workspaces and gain administrative control. This matters most for multi-tenant or shared Flowise deployments, where a takeover exposes other tenants' agent flows, stored credentials, and connected data sources. Near-term exploitation risk is modest: EPSS is 0.4% (top 68%), the CVE is not in CISA KEV, no public exploit or Nuclei template exists, and CISA SSVC says ATTEND. The attack still needs an authenticated account and high complexity, since the attacker must know or guess a victim organization ID. Upgrade to Flowise 3.1.4 or later, and until then review organization and workspace membership for unexpected owners or newly created workspaces.

Sources:NVDEPSSGitHub Advisoryvulncheck.comATLAS

What is the risk?

High (CVSS 7.5). The flaw is network-reachable and needs only low privileges and no user interaction, but attack complexity is high. Impact is rated high for confidentiality, integrity and availability. Exposure is concentrated in enterprise or multi-tenant Flowise deployments with organization and workspace features enabled. Exploitation likelihood is currently low (EPSS 0.4%, no KEV listing, no public PoC), though the issue is a simple authorization flaw that is easy to weaponize once an attacker has any account. Confidence in the facts above is HIGH (vendor advisory and VulnCheck).

How does the attack unfold?

Initial Access

The attacker obtains a low-privilege authenticated account on a Flowise instance.

AML.T0012

Exploitation

The attacker sends a victim organization ID to the organizationuser endpoint, which does not check tenant scope, and becomes organization owner.

AML.T0049

Privilege Escalation

The attacker creates workspaces in the victim organization and gains administrative control over it.

AML.T0049

Impact

The attacker steals stored credentials and API keys, and tampers with or destroys agent flows.

AML.T0083

Initial Access

The attacker obtains a low-privilege authenticated account on a Flowise instance.

AML.T0012

Exploitation

The attacker sends a victim organization ID to the organizationuser endpoint, which does not check tenant scope, and becomes organization owner.

AML.T0049

Privilege Escalation

The attacker creates workspaces in the victim organization and gains administrative control over it.

AML.T0049

Impact

The attacker steals stored credentials and API keys, and tampers with or destroys agent flows.

AML.T0083

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	—	No patch

Do you use Flowise? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 34% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACHigh

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade Flowise to 3.1.4 or later. 2) Until patched, restrict sign-up and account creation, and limit access to the enterprise organization and workspace endpoints (organizationuser, workspace) at the reverse proxy or WAF. 3) Audit organization membership and roles for unexpected owners or admins, and review recently created workspaces. 4) Review API and access logs for requests to the organizationuser and workspace endpoints that carry organization IDs different from the caller's own. 5) If abuse is suspected, rotate credentials and API keys stored in Flowise for LLM providers, vector databases and integrations. 6) Avoid exposing Flowise directly to the internet, and put it behind SSO or a VPN.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassData LeakageFrameworkAgentAPIAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0083- Credentials from AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks and mechanisms to supersede or deactivate AI systems

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-91930?

Is CVE-2026-91930 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-91930, increasing the risk of exploitation.

How to fix CVE-2026-91930?

1) Upgrade Flowise to 3.1.4 or later. 2) Until patched, restrict sign-up and account creation, and limit access to the enterprise organization and workspace endpoints (organizationuser, workspace) at the reverse proxy or WAF. 3) Audit organization membership and roles for unexpected owners or admins, and review recently created workspaces. 4) Review API and access logs for requests to the organizationuser and workspace endpoints that carry organization IDs different from the caller's own. 5) If abuse is suspected, rotate credentials and API keys stored in Flowise for LLM providers, vector databases and integrations. 6) Avoid exposing Flowise directly to the internet, and put it behind SSO or a VPN.

What systems are affected by CVE-2026-91930?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-tenant LLM orchestration platforms, RAG pipelines, low-code AI workflow builders.

What is the CVSS score for CVE-2026-91930?

CVE-2026-91930 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.40%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-tenant LLM orchestration platformsRAG pipelineslow-code AI workflow builders

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0083Credentials from AI Agent Configuration

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

Flowise before 3.1.4 fails to scope enterprise organization and workspace membership APIs to the caller's tenant, allowing authenticated users to supply arbitrary organization IDs. Attackers can add themselves as organization owners, create workspaces, and gain administrative access to victim organizations by exploiting insufficient tenant isolation in the organizationuser and workspace endpoints.

Exploitation Scenario

An attacker registers or compromises a low-privilege account on a shared Flowise instance. They learn or guess the ID of a target organization, then call the organizationuser endpoint with that ID to add themselves as organization owner. Next they create a workspace inside the victim organization and enumerate its chatflows, credentials and API keys. They exfiltrate the stored LLM and vector database keys, and may modify agent flows to add a tool that leaks conversation data or runs attacker-controlled actions.

Weaknesses (CWE)

CWE-266Incorrect Privilege AssignmentPrimary CWE-266Incorrect Privilege Assignment

CWE-266 — Incorrect Privilege Assignment: A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design, Operation] Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.

Source: MITRE CWE corpus.