The Flowise application before version 3.1.3 contains an incomplete credential redaction flaw in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. This vulnerability allows authenticated users with the credentials:view permission to retrieve sensitive data such as database connection URLs that include passwords, cloud service account JSON files with private keys, and API keys, effectively disclosing confidential credentials. The weakness is classified as CWE-200 Sensitive Information Exposure.

The affected product is Flowise by FlowiseAI. All installations running a version earlier than 3.1.3 are vulnerable, specifically the credential management API endpoint used by users granted the credentials:view permission.

The CVSS score of 7.1 indicates high severity for credential disclosure. The EPSS score is not available at this time, so the likelihood of exploitation is unknown. Because the vulnerability requires authentication with credentials:view permission, an attacker must first log in or acquire valid credentials. Once authenticated, the attacker can call the endpoint to retrieve and exfiltrate plaintext secrets, potentially compromising downstream databases or cloud accounts. The vulnerability is not listed in CISA's KEV catalog.