The vulnerability allows an authenticated user to request credentials with a credentialName filter parameter and receive the encryptedData field as part of the response. The encrypted credential data is therefore exposed to anyone able to perform that filtered query. This breach of confidentiality is a classic data‑exposure weakness classified as CWE‑200.

Products affected are FlowiseAI’s Flowise application. All releases prior to version 3.1.2 are impacted; the problem was fixed in 3.1.2.

The CVSS score of 7 indicates a moderate to high severity. Because the exploit requires the ability to perform filtered credential queries, the attack vector is likely remote via the web or API interface. An attacker who has access to the Flowise deployment or can authenticate with sufficient privileges can retrieve sensitive encrypted credential information. The EPSS score is not available, and the vulnerability is not currently listed in CISA’s KEV catalog, but the potential for credential compromise warrants prompt attention.