The missing authorization in the POST /api/v1/openai-assistants-file/download endpoint allows an unauthenticated attacker to retrieve any private file from any chatflow. By supplying a valid chatflowId, chatId, and fileName, a malicious actor can download content belonging to other workspaces or organizations. The flaw bypasses all session and API key checks because the endpoint is mistakenly included in the global authentication whitelist, undermining data confidentiality.

The vulnerability affects FlowiseAI Flowise installations running versions 2.2.4 through 3.1.4 inclusive. All tenants on the instance are at risk if they host private chatflows or files.

The CVSS score of 8.7 indicates high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of authentication makes exploitation trivial for any actor with network access to the API. Attackers can trigger the download via an unauthenticated HTTP POST request without needing credentials, making the attack surface wide and easy to leverage.