High severity7.5NVD Advisory· Published Sep 15, 2026

CVE-2026-91937

Description

Flowise before 3.1.4 fails to sanitize the overrideConfig.sessionId parameter before using it in MongoDB queries within the MongoDBMemory node. Unauthenticated attackers can submit MongoDB operator objects through the prediction API to read chat history records belonging to other users from the shared collection.

Affected products

Flowiseai/Flowisellm-fuzzy
Range: <3.1.4

Patches

Vulnerability mechanics

References

github.com/FlowiseAI/Flowise/security/advisories/GHSA-wpvf-4vfx-rgxmnvd
www.vulncheck.com/advisories/flowise-before-3.1.4-nosql-injection-via-sessionidnvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000