CVE-2026-42861 | FlowiseAI Flowise up to 3.0.12 API Endpoint createLead dynamically-determined object attributes

A vulnerability was found in FlowiseAI Flowise up to 3.0.12 and classified as critical. Affected by this issue is the function createLead of the component API Endpoint. Such manipulation leads to dynamically-determined object attributes.

This vulnerability is traded as CVE-2026-42861. The attack may be launched remotely. Furthermore, there is an exploit available.

It is suggested to upgrade the affected component.