Description
Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace (findOneBy({ id: credentialId }) with no workspaceId condition) in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant (GET /api/v1/openai-assistants and /api/v1/openai-assistants/:id), uploadFilesToAssistant (POST /api/v1/openai-assistants-file/upload/), deleteAssistant (DELETE /api/v1/assistants/:id, reachable by first importing a poisoned assistant row via POST /api/v1/export-import/import), and the shared helper used by getVoices (GET /api/v1/text-to-speech/voices). An authenticated user of one workspace can supply a credential UUID belonging to another workspace, causing the server to decrypt and use that workspace's OpenAI or ElevenLabs API key on the attacker's behalf. No patched version was available at the time of publication.
Published: 2026-09-26
Score: 7.6 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Credential Use
Action: Apply Mitigation
AI Analysis

Impact

Flowise versions up to 3.1.4 retrieve a credential by its UUID without verifying that the credential belongs to the requesting workspace. This allows an authenticated user to supply a UUID of a credential from another workspace, leading the server to decrypt and use the victim’s OpenAI or ElevenLabs API key. The attacker can then issue calls to external APIs on the victim’s behalf, potentially incurring costs, leaking data, or abusing resources.

Affected Systems

Flowise AI, the framework for building AI‑powered applications, distributed under the npm packages 'flowise' and 'flowise-components'. The vulnerability exists in all releases up to and including 3.1.4. The affected vendor is FlowiseAI, listed in the CNA data.

Risk and Exploitability

The CVSS base score of 7.6 indicates a high risk of compromise. Exploitation requires an authenticated user who can discover or guess a cross‑workspace credential UUID and has access to the relevant API endpoints (e.g., GET /api/v1/openai-assistants/:id, POST /api/v1/openai-assistants-file/upload/, DELETE /api/v1/assistants/:id). Although no EPSS score is available, environments with many users and visible credential identifiers present a moderate‑to‑high likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, but it enables lateral privilege escalation by allowing an attacker to decrypt and use another workspace’s API keys.

Generated by OpenCVE AI on September 26, 2026 at 16:54 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Enforce workspace‑level access control so that credential lookups require a matching workspaceId condition.
  • Limit and rotate OpenAI and ElevenLabs API keys across all workspaces, ensuring least privilege and minimal scope.
  • Implement monitoring of outbound API calls to detect anomalous usage and generate alerts for credential misuse.

Generated by OpenCVE AI on September 26, 2026 at 16:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sat, 26 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Description Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace (findOneBy({ id: credentialId }) with no workspaceId condition) in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant (GET /api/v1/openai-assistants and /api/v1/openai-assistants/:id), uploadFilesToAssistant (POST /api/v1/openai-assistants-file/upload/), deleteAssistant (DELETE /api/v1/assistants/:id, reachable by first importing a poisoned assistant row via POST /api/v1/export-import/import), and the shared helper used by getVoices (GET /api/v1/text-to-speech/voices). An authenticated user of one workspace can supply a credential UUID belonging to another workspace, causing the server to decrypt and use that workspace's OpenAI or ElevenLabs API key on the attacker's behalf. No patched version was available at the time of publication.
Title Flowise through 3.1.4 Insecure Direct Object Reference via Credential
First Time appeared Flowiseai
Flowiseai flowise
Weaknesses CWE-639
CPEs cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*
Vendors & Products Flowiseai
Flowiseai flowise
References
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N'}

cvssV4_0

{'score': 7.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Flowiseai Flowise
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-30T12:50:05.029Z

Reserved: 2026-09-26T02:30:34.352Z

Link: CVE-2026-100609

cve-icon Vulnrichment

Updated: 2026-09-30T12:49:54.915Z

cve-icon NVD

Status : Deferred

Published: 2026-09-26T14:16:41.297

Modified: 2026-09-30T13:17:15.820

Link: CVE-2026-100609

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T17:00:15Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key