[flowise] Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint

**[flowise] Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint**

Summary A Mass Assignment vulnerability in the /api/v1/leads endpoint allows any unauthenticated user to control internal entity fields (id, createdDate, chatId) by including them in the request body. The endpoint uses Object.assign() to copy all properties from the request body to the Lead entity without any input validation or field filtering. This allows attackers to bypass auto-generated fields and inject arbitrary values. Field Value Vulnerability Type Mass Assignment CWE ID CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes Authentication Required None Affected Endpoint POST /api/v1/leads Details Root Cause The vulnerability exists in /packages/server/src/services/leads/index.ts at lines 27-28: // File: /packages/server/src/services/leads/index.ts // Lines 23-38 const createLead = async (body: Partial<ILead>) => { try { const chatId = body.chatId ?. uuidv4() const newLead = new Lead() Object.assign(newLead, body) // ← VULNERABILITY: All properties copied...

---

**[devsupporter 해설]**

이 기사는 GitHub Security Advisories에서 제공하는 최신 개발 동향입니다. 관련 도구나 기술에 대해 더 알아보시려면 원본 링크를 참고하세요.