What is CVE-2026-30822?

CVE-2026-30822 is a high-severity vulnerability in Flowiseai Flowise, classified under Improperly Controlled Modification of Dynamically-Determined Object Attributes. CVSS score: 7.7/10. Published 2026-03-07.

How severe is CVE-2026-30822?

High severity. CVSS v3 base score is 7.7 out of 10.

Vulnerability in Flowiseai Flowise

CVE-2026-30822

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, unauthenticated users can inject arbitrary values into internal database fields when creating leads. This issue has been patched in version 3.0.13.

Vulnerability class: Mass Assignment

EPSS: 0.129 (95.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.7 (High). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L.

Affected products

Flowiseai Flowise — versions < 3.0.13

Weakness classification (CWE)

CWE-915 — Improperly Controlled Modification of Dynamically-Determined Object Attributes

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Mitigation, Vendor Advisory)
security-advisories@github.com (Product, x_refsource_MISC, Release Notes)

Frequently asked questions

What is CVE-2026-30822?: CVE-2026-30822 is a high-severity vulnerability in Flowiseai Flowise, classified under Improperly Controlled Modification of Dynamically-Determined Object Attributes. CVSS score: 7.7/10. Published 2026-03-07.
How severe is CVE-2026-30822?: High severity. CVSS v3 base score is 7.7 out of 10.