CVE-2026-100609

Flowise through 3.1.4 Insecure Direct Object Reference via Credential

Published Sep 26, 2026 CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Description

Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace (findOneBy({ id: credentialId }) with no workspaceId condition) in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant (GET /api/v1/openai-assistants and /api/v1/openai-assistants/:id), uploadFilesToAssistant (POST /api/v1/openai-assistants-file/upload/), deleteAssistant (DELETE /api/v1/assistants/:id, reachable by first importing a poisoned assistant row via POST /api/v1/export-import/import), and the shared helper used by getVoices (GET /api/v1/text-to-speech/voices). An authenticated user of one workspace can supply a credential UUID belonging to another workspace, causing the server to decrypt and use that workspace's OpenAI or ElevenLabs API key on the attacker's behalf. No patched version was available at the time of publication.

Analysis

Technical impact

Flowise versions up to 3.1.4 retrieve a credential by its UUID without verifying that the credential belongs to the requesting workspace. This allows an authenticated user to supply a UUID of a credential from another workspace, leading the server to decrypt and use the victim’s OpenAI or ElevenLabs API key. The attacker can then issue calls to external APIs on the victim’s behalf, potentially incurring costs, leaking data, or abusing resources.

Affected Systems

Flowise AI, the framework for building AI‑powered applications, distributed under the npm packages 'flowise' and 'flowise-components'. The vulnerability exists in all releases up to and including 3.1.4. The affected vendor is FlowiseAI, listed in the CNA data.

Risk and Exploitability

The CVSS base score of 7.6 indicates a high risk of compromise. Exploitation requires an authenticated user who can discover or guess a cross‑workspace credential UUID and has access to the relevant API endpoints (e.g., GET /api/v1/openai-assistants/:id, POST /api/v1/openai-assistants-file/upload/, DELETE /api/v1/assistants/:id). Although no EPSS score is available, environments with many users and visible credential identifiers present a moderate‑to‑high likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, but it enables lateral privilege escalation by allowing an attacker to decrypt and use another workspace’s API keys.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

FlowiseAI

Flowise

unaffected

Version	Status	Constraints
`0`	affected	≤ 3.1.4

FlowiseAI

Flowise

unaffected

Version	Status	Constraints
`0`	affected	≤ 3.1.4

No data.

Vendor Product Versions

Flowiseai

Flowise

Version	Status	Scheme	Platform
`[0,3.1.4]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Enforce workspace‑level access control so that credential lookups require a matching workspaceId condition.
Limit and rotate OpenAI and ElevenLabs API keys across all workspaces, ensuring least privilege and minimal scope.
Implement monitoring of outbound API calls to detect anomalous usage and generate alerts for credential misuse.

Generated by OpenCVE AI on September 26, 2026 at 16:54 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.295% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-27w2-26m5-x82c
https://www.vulncheck.com/advisories/flowise-through-3.1.4-insecure-direct-object-reference-via-credential

History

Sep 30, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 26, 2026 1:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace (findOneBy({ id: credentialId }) with no workspaceId condition) in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant (GET /api/v1/openai-assistants and /api/v1/openai-assistants/:id), uploadFilesToAssistant (POST /api/v1/openai-assistants-file/upload/), deleteAssistant (DELETE /api/v1/assistants/:id, reachable by first importing a poisoned assistant row via POST /api/v1/export-import/import), and the shared helper used by getVoices (GET /api/v1/text-to-speech/voices). An authenticated user of one workspace can supply a credential UUID belonging to another workspace, causing the server to decrypt and use that workspace's OpenAI or ElevenLabs API key on the attacker's behalf. No patched version was available at the time of publication.
Title		Flowise through 3.1.4 Insecure Direct Object Reference via Credential
First Time appeared		Flowiseai Flowiseai flowise
Weaknesses		CWE-639
CPEs		cpe:2.3:a:flowiseai:flowise::::::::
Vendors & Products		Flowiseai Flowiseai flowise
References		https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-27w2-26m5-x82c https://www.vulncheck.com/advisories/flowise-through-3.1.4-insecure-direct-object-reference-via-credential
Metrics		cvssV3_1 `{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N'}` cvssV4_0 `{'score': 7.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}`