A critical vulnerability in Flowise allows unauthenticated attackers to perform unauthorized database modifications, risking the integrity of user-defined LLM workflows.

This vulnerability is caused by improper control over dynamically determined object attributes (CWE-915). It allows an unauthenticated attacker to manipulate internal database fields during the lead creation process.

The ability for an unauthenticated user to inject arbitrary data into the application database poses a significant risk to data integrity and system security. With a CVSS score of 7.7, this high-severity flaw could lead to unauthorized system configuration changes or the corruption of sensitive LLM flow logic, potentially resulting in downstream operational impact or unauthorized access to backend processes.

Immediate Action: Update Flowise to version 3.0.13 or later immediately to incorporate the provided security fix.

Proactive Monitoring: Review application access logs for suspicious lead submission patterns or unexpected database write activity originating from unauthenticated sessions.

Compensating Controls: Implement strict network access controls to limit exposure of the Flowise interface and utilize a Web Application Firewall (WAF) to filter malicious input payloads targeting the lead creation endpoint.

Public Exploit Available: Unknown

Given the high CVSS severity and the existence of a proof-of-concept, organizations must prioritize patching this vulnerability. Failure to update to version 3.0.13 leaves the application exposed to unauthorized database manipulation by any network-adjacent attacker. Immediate deployment of the vendor patch is the only reliable method to mitigate this risk.