Flowsie DatasetRow Mass-Assignment Cross-Workspace Takeover Advisory

Vulnerability Overview DatasetRow create+update mass-assignment allows cross-workspace row takeover Type: Mass-assignment via allows attackers to overwrite (during both creation and updates), leading to cross-workspace data takeover. File: Root Cause: The controller/service constructs a new instance and copies content from the request body into it via without explicitly whitelisting fields. Consequently, the request body can contain , , and . While the server allows overriding certain fields (such as and ) only during creation, during updates, it overwrites the but fails to prevent from being overwritten. Remaining client-controlled values are directly applied to the persisted row, breaking workspace isolation. Impact Scope Affected Versions: <= 3.1.1 Fixed Version: 3.1.2 Severity: High (7.7 / 10) CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Confidentiality: High - Integrity: High - Availability: High (Note: The original text mentioned "CVSS v4" but listed metrics and a score consistent with CVSS v3. The translation reflects the provided metrics accurately.) Exploit Chain 1. The attacker is an authorized member of Workspace A and possesses a valid session cookie/JWT for the Flowsie Web UI. At this stage, the attacker can read and write data in Workspace A. 2. The attacker creates a dataset in Workspace A via the documented API and records its entity ID. 3. The attacker sends a POST request to (or an equivalent endpoint) with a JSON body containing (the UUID of any other workspace). Although the request arrives at the controller as an authorized request on behalf of Workspace A, it contains the malicious payload. 4. The controller calls . The in the request body overwrites the entity's field. The persistence layer commits this row. 5. Result: The dataset row is now owned by Workspace B. Members of Workspace B can view, modify, and use it. Workspace A loses access to the row (as it no longer satisfies its workspace filter). No audit logs are generated for the original creator because the operation appears as a normal update. Security Impact Severity: High. Any authorized workspace member can violate cross-workspace boundaries. Attacker Capabilities: Any authenticated user with permission to use datasets can move them to any workspace whose UUID can be exposed or enumerated. Dataset rows are exposed in multiple API responses, making enumeration trivial. Since dataset rows contain personal training/validation records, mass-assignment allows a member to reconstruct a row into another workspace's dataset, thereby exposing the row's contents to the target workspace. Prerequisites: An authenticated session with edit privileges. No second-factor authentication is required. Workspace UUIDs are exposed via or through the fields of other cross-referenced entities, making target enumeration trivial. Patch Verification: The PoC was validated by inspecting the original source code for GHSA-q42p-d28-c9fr. The patched build (applying the suggested fix) rejects the field. Without this fix, the application remains vulnerable to the attack and retains the field. Remediation Fixed: PR #6051 (implemented an allowlist pattern).

Goal Reached Thanks to every supporter — we hit 100%!

Flowsie DatasetRow Mass-Assignment Cross-Workspace Takeover Advisory

More from this source