---
id: CVE-2026-91937
title: >-
  Flowise before 3.1.4 fails to sanitize the overrideConfig.sessionId parameter
  before using it in MongoDB queries within the MongoDBMemory node
summary: >-
  Flowise before 3.1.4 fails to sanitize the overrideConfig.sessionId parameter
  before using it in MongoDB queries within the MongoDBMemory node.
  Unauthenticated attackers can submit MongoDB operator objects through the
  prediction API to r…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-943
vendor: FlowiseAI
product: Flowise
affected:
  - Flowise < 3.1.4
published: '2026-09-15'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:47.107'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-91937'
references:
  - url: >-
      https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wpvf-4vfx-rgxm
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/flowise-before-3.1.4-nosql-injection-via-sessionid
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.0047
epssPercentile: 0.37955
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-15T17:00:53.079188Z'
ingestedAt: '2026-09-15T15:39:12.926Z'
---

## Overview

Flowise before 3.1.4 fails to sanitize the overrideConfig.sessionId parameter before using it in MongoDB queries within the MongoDBMemory node. Unauthenticated attackers can submit MongoDB operator objects through the prediction API to read chat history records belonging to other users from the shared collection.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.