Flowise, a LLM flow builder, has a flaw where OAuth2 credential endpoints identify credentials solely by their UUID without verifying the workspace context. This causes credential data to be exposed and allows authorized users to trigger flows against credentials in other workspaces. Additionally, unauthenticated attackers can forge callback requests to overwrite tokens and can refresh tokens for any credential. The vulnerability is a restricted functionality violation (CWE‑863) that can lead to unauthorized credential manipulation and data exposure.

The product affected is Flowise by FlowiseAI. Versions prior to 3.1.3 are vulnerable. Specifically, the endpoint patterns /api/v1/oauth2-credential/authorize/<UUID>, /callback, and /refresh/<UUID> are impacted.

The CVSS score of 7.6 indicates a high risk level, but the EPSS score is not available, and the vulnerability is not listed in CISA KEV. Exploitation requires either authenticated access to initiate cross‑workspace flows or unauthenticated access to craft callback or refresh requests; the former is easier when the attacker has a username, while the latter works without credentials. The lack of workspace filtering makes the attack straightforward once the endpoint is reached.