Before release 3.1.3, Flowise’s openai‑assistants‑vector‑store endpoints accepted a credential identifier supplied by the caller and fetched the corresponding credential without validating that it belonged to the caller’s workspace. An attacker can provide a credential ID from a different workspace, triggering decryption of the victim’s OpenAI key and allowing the attacker to read, modify, or delete target vector stores and files, as well as incur charges on the victim’s OpenAI account. This results in confidentiality, integrity, availability, and financial impacts for the affected workspace.

The vulnerability affects FlowiseAI’s Flowise product. Any installation running a version older than 3.1.3 is susceptible; the issue is corrected in version 3.1.3 and later.

The CVSS score of 7.1 signals a high‑moderate severity. Because the flaw is exploitable via normal web requests to the affected endpoints, an attacker who can identify or guess a victim credential ID can compromise another tenant. No EPSS score is reported, and the vulnerability is not currently listed in the CISA KEV catalog, but the lack of a verification of the workspace ID creates an immediate multi‑tenant boundary violation. The attack does not require privileged credentials beyond the attacker’s access to the vulnerable Flowise instance, making it relatively low‑complexity from an attacker’s standpoint.