CVE-2026-8027

MediumCVSS 4.3/10Last modified Oct 26, 2026

Description

A weakness has been identified in FlowiseAI Flowise up to 3.0.12. Affected by this vulnerability is an unknown functionality of the component User Controller Handler. This manipulation of the argument userId/organizationId/workspaceId/email causes authorization bypass. The attack may be initiated remotely. The affected component should be upgraded.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-285 CWE-639

Affected software

Vendor	Product	Versions
FlowiseAI	Flowise	3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; 3.0.5; 3.0.6; 3.0.7; 3.0.8; 3.0.9; 3.0.10; 3.0.11; 3.0.12

References

https://gist.github.com/YLChen-007/3584e6ffa0bba6367328ecf0b46b0e4bExploit, Third Party Advisory
https://vuldb.com/submit/777657Third Party Advisory, VDB Entry
https://vuldb.com/vuln/361274Third Party Advisory, VDB Entry
https://vuldb.com/vuln/361274/ctiPermissions Required, VDB Entry
https://vuldb.com/submit/777657Third Party Advisory, VDB Entry

Timeline

Published: May 6, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-802747.5If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer a CVE-2026-802758.8Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an a CVE-2026-802767.5Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 expose a network-accessible management interface CVE-2026-80283.7A vulnerability was detected in FlowiseAI Flowise up to 3.0.12. This affects the function verify of the file packages/server/src/enterprise/CVE-2026-80293.9The ZTE Smart Life app contains an SQL injection vulnerability that allows attackers to execute UNION SELECT statements to query sensitive d CVE-2026-802988.8Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platfor CVE-2026-80304.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 th CVE-2026-803018.8Improper isolation in the Avast sandbox on Windows allows a local, low-privileged attacker executing inside the sandbox to access COM interf CVE-2026-803028.8Insufficient isolation in the Avast sandbox file virtualization layer on Windows allows a local, low-privileged attacker executing inside th CVE-2026-803036.2An integer underflow vulnerability in the Avast Windows Filtering Platform (WFP) stream parser on Windows allows denial of service by causin CVE-2026-80315.3A vulnerability was detected in PicoTronica e-Clinic Healthcare System ECHS 5.7. The affected element is an unknown function of the file /cd CVE-2026-803114.3The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscription belongs to the customer bound to