The Spread Operator Is an Allowlist With Nothing In It: CVE-2026-69258 in Flowise

Three characters of JavaScript grant an unauthenticated caller write access to every field in an object, including the ones you add six months later. Here is the primitive, the sink, the CWE argument, and the grep that finds it in your own…