Sign in
Deutsch English Español Polski
High

Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store

  • Disclosed: 04.08.2026
  • Updated: 11.10.2026 10:22

Summary

These endpoints accept a client-controlled credential parameter. The server loads credentials by id and uses them directly, without checking whether that credential belongs to the caller’s workspace. If an attacker knows another workspace’s credentialId, they can use that workspace’s OpenAI key.

Details

Route permissions (assistants:*) only check feature access. They do not check credential ownership. The controller passes req.query.credential straight to the service. The service does findOneBy({ id: credentialId }), decrypts the credential, and calls OpenAI APIs. There is no workspaceId check in this flow, so this is an IDOR.

Impact

  • Cross-workspace unauthorized use of stored OpenAI keys.
  • Unauthorized read/modify/delete of victim vector stores and files.
  • Direct billing impact on victim OpenAI account.
  • Multi-tenant boundary violation with practical exploitability.

Reproduction steps

  1. Set up two workspaces: A (attacker) and B (victim), each with an OpenAI credential.
  2. Log in as a user in workspace A (with assistants-related permissions).
  3. Call /api/v1/openai-assistants-vector-store and set credential to B’s credential ID.
  4. Example: GET /api/v1/openai-assistants-vector-store?credential=<B_credentialId>.
  5. If responses/actions are executed using B’s credential context, the issue is confirmed.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package flowise < 3.1.3 3.1.3

References

CVSS score -
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:H/SA:H
Weakness (CWE)
CWE-285, CWE-863
Platform
npm
Package
flowise
Disclosed
04.08.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-chm3-vqcf-52rx - CC BY 4.0

Vulnerability history: flowise

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (114) in the archive
Total entries
114
First → latest
04.2024 10.2026
Without a fix
16
Exploited in attacks
0

Severity breakdown

  • Critical 28
  • High 62
  • Medium 24

Disclosures per year

Severity:
  1. Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass
    Critical CVE-2026-73487 < 3.1.3 3.1.3
  2. Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium
    Critical CVE-2026-73483 < 3.1.3 3.1.3
  3. Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service
    Critical CVE-2026-70478 < 3.1.3 3.1.3
  4. Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
    Critical CVE-2026-70477 < 3.1.3 3.1.3
  5. Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation
    High CVE-2026-70476 < 3.1.3 3.1.3
  6. Flowise: Missing Authorization on Execution Update Endpoint
    High CVE-2026-70475 < 3.1.3 3.1.3
  7. Flowise: Cross-Workspace OAuth2 Credential Metadata Leak
    High CVE-2026-70474 < 3.1.3 3.1.3
  8. Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history
    High CVE-2026-70473 < 3.1.3 3.1.3
  9. Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store this entry
    High CVE-2026-70472 < 3.1.3 3.1.3
  10. Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation
    Critical CVE-2026-69264 < 3.1.3 3.1.3
  11. Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys
    High ghsa-88pr-878c-24wf < 3.1.3 3.1.3
  12. Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure
    High CVE-2026-70471 < 3.1.3 3.1.3
  13. Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE
    Critical CVE-2026-70470 < 3.1.3 3.1.3
  14. Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)
    High CVE-2026-69263 < 3.1.3 3.1.3
  15. Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow type
    High CVE-2026-69262 < 3.1.3 3.1.3
  16. Flowise RCE via SQLite Record Manager Node
    Critical CVE-2026-69259 < 3.1.3 3.1.3
  17. Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API
    High CVE-2026-69258 < 3.1.3 3.1.3
  18. Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses
    High CVE-2026-69257 < 3.1.3 3.1.3
  19. Flowise: Remote Code Execution Vulnerability in CSVAgent
    Critical CVE-2026-69256 < 3.1.3 3.1.3
  20. Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
    Critical CVE-2026-69255 < 3.1.3 3.1.3
  21. Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override
    Critical CVE-2026-69254 < 3.1.3 3.1.3
  22. Flowise Sandbox Escape to RCE
    Critical CVE-2026-69253 < 3.1.3 3.1.3
  23. Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization
    High CVE-2026-69252 < 3.1.3 3.1.3
  24. Flowise RCE via TypeORM DataSource
    Critical CVE-2026-69251 < 3.1.3 3.1.3
  25. Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration
    High CVE-2026-69250 < 3.1.3 3.1.3
  26. FlowiseAI: Evaluator create+update mass-assignment allows cross-workspace evaluator takeover
    High · 8.8 CVE-2026-46480 < 3.1.2 3.1.2
  27. FlowiseAI: Evaluation create+update mass-assignment allows cross-workspace evaluation takeover
    High · 8.8 CVE-2026-46479 < 3.1.2 3.1.2
  28. FlowiseAI: DatasetRow create+update mass-assignment allows cross-workspace row takeover
    High · 8.8 CVE-2026-46478 < 3.1.2 3.1.2
  29. FlowiseAI: Dataset create+update mass-assignment allows cross-workspace dataset takeover
    High · 8.8 CVE-2026-46477 < 3.1.2 3.1.2
  30. FlowiseAI: CustomTemplate create+update mass-assignment allows cross-workspace template takeover
    High CVE-2026-46476 < 3.1.2 3.1.2
  31. FlowiseAI: Assistant create+update mass-assignment allows cross-workspace assistant takeover
    High · 8.8 CVE-2026-46475 < 3.1.2 3.1.2
  32. FlowiseAI: Vector Store No Permission Checks
    High · 8.8 CVE-2026-46444 < 3.1.2 3.1.2
  33. FlowiseAI Vulnerable to Credential Data Leak
    High CVE-2026-46443 < 3.1.2 3.1.2
  34. FlowiseAI: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape
    Critical CVE-2026-46442 < 3.1.2 3.1.2
  35. FlowiseAI has Mass Assignment in Assistant Update Endpoint that Allows Cross-Workspace Resource Reassignment
    High CVE-2026-46441 < 3.1.2 3.1.2
  36. Flowise has an MCP Security Bypass that Enables RCE
    High CVE-2026-56274 < 3.1.2 3.1.2
  37. FlowiseAI Exposes Basic Auth Credentials via API
    High · 7.5 CVE-2026-46440 < 3.1.2 3.1.2
  38. FlowiseAI has Mass Assignment in Chatflow Update Endpoint that Allows Cross-Workspace AgentFlow Reassignment
    High CVE-2026-42863 < 3.1.2 3.1.2
  39. FlowiseAI has Mass Assignment in Tool Update Endpoint that Allows Cross-Workspace Resource Reassignment
    High CVE-2026-42862 < 3.1.2 3.1.2
  40. FlowiseAI has Mass Assignment in Variable Update Endpoint that Allows Cross-Workspace Resource Reassignment
    High CVE-2026-42861 < 3.1.2 3.1.2
  41. Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
    Critical · 9.8 CVE-2026-41264 < 3.1.0 3.1.0
  42. Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability
    Critical · 9.8 CVE-2026-41265 < 3.1.0 3.1.0
  43. Flowise: Unauthenticated TTS endpoint accepts arbitrary credential IDs — enables API credit abuse via stored credentials
    High · 7.5 CVE-2026-41279 < 3.1.0 3.1.0
  44. Flowise: Public chatflow endpoints return unsanitized flowData including plaintext API keys, passwords, and credential IDs
    High · 7.5 CVE-2026-41278 < 3.1.0 3.1.0
  45. Flowise: Mass Assignment in DocumentStore Create Endpoint Leads to Cross-Workspace Object Takeover (IDOR)
    High · 8.8 CVE-2026-41277 < 3.1.0 3.1.0
  46. Flowise: resetPassword Authentication Bypass Vulnerability
    High · 9.8 CVE-2026-41276 < 3.1.0 3.1.0
  47. Flowise: Cypher Injection in GraphCypherQAChain
    High CVE-2026-41274 < 3.1.0 3.1.0
  48. Flowise: Password Reset Link Sent Over Unsecured HTTP
    High · 7.5 CVE-2026-41275 < 3.1.0 3.1.0
  49. Flowise: Unauthenticated OAuth 2.0 Access Token Disclosure via Public Chatflow in Flowise
    High · 8.2 CVE-2026-41273 < 3.1.0 3.1.0
  50. Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains
    High · 7.1 CVE-2026-41271 < 3.1.0 3.1.0
  51. Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure)
    High · 7.1 CVE-2026-41272 < 3.1.0 3.1.0
  52. Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox
    High · 7.1 CVE-2026-41270 < 3.1.0 3.1.0
  53. Flowise: File Upload Validation Bypass in createAttachment
    High · 7.1 CVE-2026-41269 < 3.1.0 3.1.0
  54. Flowise: Parameter Override Bypass Remote Command Execution
    High · 7.7 CVE-2026-41268 < 3.1.0 3.1.0
  55. Flowise: Sensitive Data Leak in public-chatbotConfig
    High · 7.5 CVE-2026-41266 < 3.1.0 3.1.0
  56. Flowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association
    High · 8.1 CVE-2026-41267 < 3.1.0 3.1.0
  57. Flowise: Code Injection in CSVAgent leads to Authenticated RCE
    Critical · 8.8 CVE-2026-41137 < 3.1.0 3.1.0
  58. Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas`.
    High · 8.3 CVE-2026-41138 < 3.1.0 3.1.0
  59. Flowise: Authenticated RCE Via MCP Adapters
    Critical · 9.9 CVE-2026-40933 < 3.1.0 3.1.0
  60. Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access
    High · 7.1 CVE-2026-31829 < 3.0.13 3.0.13
  61. Flowise Missing Authentication on NVIDIA NIM Endpoints
    High CVE-2026-30824 < 3.0.13 3.0.13
  62. Flowise has IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration
    High · 8.8 CVE-2026-30823 < 3.0.13 3.0.13
  63. Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint
    High · 7.7 CVE-2026-30822 < 3.0.13 3.0.13
  64. Flowise has Arbitrary File Upload via MIME Spoofing
    High CVE-2026-30821 < 3.0.13 3.0.13
  65. Flowise has Authorization Bypass via Spoofed x-request-from Header
    High CVE-2026-30820 < 3.0.13 3.0.13
  66. Flowise has Authentication Bypass Using Unprotected Registration Endpoint (/register)
    High CVE-2025-71327 = 3.0.1 no fix
  67. Flowise Fails to Invalidate Existing Sessions After Password Changes
    High · 8.1 CVE-2025-71335 < 3.0.10 3.0.10
  68. Flowise: Authenticated Command Execution and Sandbox Bypass via Puppeteer and Playwright Packages
    High CVE-2025-34267 >= 3.0.1, < 3.0.8 3.0.8
  69. Flowise is vulnerable to arbitrary file exposure through its ReadFileTool
    High · 7.7 ghsa-j44m-5v8f-gc9c < 3.0.8 3.0.8
  70. Flowise is vulnerable to arbitrary file write through its WriteFileTool
    Critical · 9.9 CVE-2025-61913 < 3.0.8, < 3.0.8 3.0.8
  71. FlowiseAI/Flosise has File Upload vulnerability
    High · 8.3 CVE-2025-61687 >= 3.0.7, < 3.0.8 3.0.8
  72. Flowise vulnerable to RCE via Dynamic function constructor injection
    Critical · 9.8 CVE-2025-55346 <= 2.2.7-patch.1 no fix
  73. Flowise is vulnerable to stored XSS via "View Messages" allows credential theft in FlowiseAI admin panel
    Critical · 9.3 CVE-2025-50538 < 3.0.8 3.0.8
  74. Flowise has unsandboxed remote code execution via Custom MCP
    High CVE-2025-71336 >= 2.2.7-patch.1, < 3.0.6 3.0.6
  75. Flowise has arbitrary file access due to missing chat flow id validation
    Critical · 9.8 CVE-2025-71334 >= 2.2.8, < 3.0.6 3.0.6
  76. Flowise has an Arbitrary File Read
    Critical · 9.1 CVE-2025-71324 >= 3.0.5, < 3.0.6 3.0.6
  77. Flowise has Remote Code Execution vulnerability
    Critical · 10.0 CVE-2025-59528 >= 3.0.5, < 3.0.6 3.0.6
  78. FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability
    High · 7.5 CVE-2025-59527 >= 3.0.5, < 3.0.6 3.0.6
  79. FlowiseAI Pre-Auth Arbitrary Code Execution
    Critical · 9.1 CVE-2025-57164 >= 3.0.5, < 3.0.6 3.0.6
  80. Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover
    Critical · 9.8 CVE-2025-58434 < 3.0.6 3.0.6
  81. Flowise OS command remote code execution
    Critical · 9.8 CVE-2025-8943 <= 3.0.5 no fix
  82. Flowise allows arbitrary file write to RCE
    Critical · 10.0 CVE-2025-71338 <= 2.2.7 no fix
  83. Flowise Pre-auth Arbitrary File Upload
    Critical CVE-2025-71333 <= 2.2.7 no fix
  84. FlowiseAI Flowise arbitrary file upload vulnerability
    High CVE-2025-26319 <= 2.2.6 no fix
  85. Flowise OverrideConfig security vulnerability
    High CVE-2024-58351 < 2.1.4 2.1.4
  86. Flowise Unauthenticated Denial of Service (DoS) vulnerability
    High · 7.5 CVE-2024-8182 <= 1.8.2 no fix
  87. Flowise Authentication Bypass vulnerability
    High · 7.3 CVE-2024-8181 <= 1.8.2 no fix
  88. Flowise Cors Misconfiguration in packages/server/src/index.ts
    High · 7.5 CVE-2024-36421 <= 1.4.3 no fix
  89. Flowise Path Injection at /api/v1/openai-assistants-file
    High · 7.5 CVE-2024-36420 <= 1.4.3 no fix
  90. Flowise vulnerable to code injection via api/v1
    High · 7.6 CVE-2024-31621 < 1.8.1 1.8.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.