Beveiligingsadvies

CVE-2026-91937

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-09-15 15:17:59

Laatst bijgewerkt 2026-09-15 17:02:01

Toegewezen door VulnCheck

CVSS-score 8.7

Status PUBLISHED

Beschrijving

Flowise before 3.1.4 fails to sanitize the overrideConfig.sessionId parameter before using it in MongoDB queries within the MongoDBMemory node. Unauthenticated attackers can submit MongoDB operator objects through the prediction API to read chat history records belonging to other users from the shared collection.

← Alle CVE's bekijken Bekijk op cve.org ↗