Flowise versions contain a broken access control flaw in the /api/v1/organizationuser GET endpoint. The flaw allows any authenticated organization member to query any user ID and receive the full user record for the organization owner, including the bcrypt password hash and temporary tokens. Because the weakness is a classic lack of proper authorization checks (CWE-862), an attacker with common organizational privileges can obtain credential material and perform offline cracking or direct reuse, enabling compromise of the highest‑privileged account.

Affected products are Flowise with all releases prior to 3.1.4. No specific sub‑product or environment details are given beyond the overall product line.

The CVSS score of 6.0 classifies this as a medium impact flaw, but the potential for credential theft and subsequent account takeover makes it high in practical risk. EPSS score is low at <1%, indicating a minimal but non‑zero likelihood of exploitation, but this does not absolve the need for mitigation. The vulnerability is not listed in CISA’s KEV catalog, indicating no known large‑scale public exploitation yet, increases the value to attackers. Attacker likely need only a valid organization member account; once authenticated request.