Advisoriesby IbisFlowise: insecure direct object reference
Summary
The POST /api/v1/prediction/:id endpoint , which is unauthenticated (whitelisted in WHITELIST_URLS) , accepts an overrideConfig object in the request body. This object is unconditionally spread into the internal flowConfig and flowData objects at two locations in the codebase without checking apiOverrideStatus. This allows an unauthenticated attacker to inject arbitrary properties into the flow execution context of any public chatflow, enabling session hijacking, cross-session data pollution, chat history manipulation, and injection of attacker-controlled values into $flow.* template variables consumed by flow nodes.
This is distinct from the previously reported overrideConfig vulnerability (GHSA-5cph-wvm9-45gj), which addressed overrideConfig's ability to modify node input parameters via replaceInputsWithConfig(). That function is properly gated behind apiOverrideStatus. The vulnerability reported here is in two separate, ungated spread operations that were not addressed by the GHSA-5cph fix.
Root Cause
In packages/server/src/utils/buildChatflow.ts at lines 557–564, the incomingInput.overrideConfig object is spread directly into flowConfig with no gating:
```typescript
// File: packages/server/src/utils/buildChatflow.ts, lines 557-564
const flowConfig: IFlowConfig = {
chatflowid,
chatflowId: chatflow.id,...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| flowise npm | < 3.1.3 | 3.1.3 |
Details and references
#### Summary The `POST /api/v1/prediction/:id` endpoint , which is unauthenticated (whitelisted in `WHITELIST_URLS`) , accepts an `overrideConfig` object in the request body. This object is unconditionally spread into the internal `flowConfig` and `flowData` objects at two locations in the codebase **without checking** `apiOverrideStatus`. This allows an unauthenticated attacker to inject arbitrary properties into the flow execution context of any public chatflow, enabling session hijacking, cross-session data pollution, chat history manipulation, and injection of attacker-controlled values into `$flow.*` template variables consumed by flow nodes. This is distinct from the previously reported `overrideConfig` vulnerability (GHSA-5cph-wvm9-45gj), which addressed overrideConfig's ability to modify **node input parameters** via `replaceInputsWithConfig()`. That function is properly gated behind `apiOverrideStatus`. The vulnerability reported here is in two **separate, ungated spread operations** that were not addressed by the GHSA-5cph fix. #### Root Cause In `packages/server/src/utils/buildChatflow.ts` at lines 557–564, the `incomingInput.overrideConfig` object is spread directly into `flowConfig` with no gating: ```typescript // File: packages/server/src/utils/buildChatflow.ts, lines 557-564 const flowConfig: IFlowConfig = { chatflowid, chatflowId: chatflow.id, chatId, sessionId, chatHistory, apiMessageId, ...incomingInput.overrideConfig // <-- UNGATED: always applied, no apiOverrideStatus check } ``` A second ungated spread exists in `packages/server/src/utils/index.ts` at lines 569–574: ```typescript // File: packages/server/src/utils/index.ts, lines 569-574 const flowData: ICommonObject = { chatflowid, chatId, sessionId, chatHistory, ...overrideConfig // <-- UNGATED: always applied, no apiOverrideStatus check } ``` **Internal inconsistency:** The node parameter override mechanism at `buildChatflow.ts:180` and `index.ts:589` IS correctly gated: ```typescript // File: packages/server/src/utils/buildChatflow.ts, line 180 if (incomingInput.overrideConfig && apiOverrideStatus) { // <-- Properly gated nodeToExecute.data = replaceInputsWithConfig(...) } ``` This demonstrates that the developers intended for `overrideConfig` processing to be gated behind `apiOverrideStatus`, but the `flowConfig` and `flowData` spreads were missed. #### Exploitation The `flowConfig` object is consumed by the `$flow.*` template variable resolution system at `packages/server/src/utils/index.ts:932-936`: ```typescript // File: packages/server/src/utils/index.ts, lines 932-936 if (variableFullPath.startsWith('$flow.') && flowConfig) { const variableValue = get(flowConfig, variableFullPath.replace('$flow.', '')) if (variableValue != null) { variableDict[`{{${variableFullPath}}}`] = variableValue returnVal = returnVal.split(`{{${variableFullPath}}}`).join(variableValue) } } ``` And identically in `packages/server/src/utils/buildAgentflow.ts:346-351`. This means any attacker-injected property in `overrideConfig` becomes accessible as a `$flow.*` variable and will be substituted into any node template that references it. The `get()` function (lodash `get`) supports nested property access, so deep object injection is possible. #### Concrete Attack Scenarios **1. Session Hijacking via `chatId` Overwrite:** An attacker sends a prediction request with `overrideConfig: { "chatId": "<victim-chat-id>" }`. Since `chatId` in `flowConfig` controls which conversation session is used for memory retrieval and storage, the attacker's messages and responses will be written to the victim's session. If the chatflow uses conversation memory (e.g., BufferMemory, ZepMemory), the attacker can: - Read the victim's prior conversation history (returned as context to the LLM) - Inject messages into the victim's conversation that will appear in subsequent interactions **2. Chat His
More Flowise advisories
All Flowise
Flowise: information disclosureCVE-2026-70478fixed in 3.1.3Flowise: CSV Agent Prompt Injection Remote Code Execution VulnerabilityCVE-2026-70477fixed in 3.1.3Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing ManipulationCVE-2026-70476fixed in 3.1.3Flowise: missing authorizationCVE-2026-73603fixed in 3.1.4Flowise: Missing Authorization on Execution Update EndpointCVE-2026-70475fixed in 3.1.3Flowise: Cross-Workspace OAuth2 Credential Metadata LeakCVE-2026-70474fixed in 3.1.3