Flowise versions prior to 3.1.4 contain a broken access control flaw in the /api/v1/organizationuser GET endpoint. The flaw allows any authenticated organization member to query any user ID and receive the full user record for the organization owner, including the bcrypt password hash and temporary tokens. Because the weakness is a classic lack of proper authorization checks (CWE-862), an attacker with common organizational privileges can obtain credential material and perform offline cracking or direct reuse, enabling compromise of the highest‑privileged account.

Affected products are FlowiseAI's Flowise application, with all releases prior to 3.1.4. No specific sub‑product or environment details are given beyond the overall product line.

The CVSS score of 6.0 classifies this as a medium impact flaw, but the potential for credential theft and subsequent account takeover makes it high in practical risk. EPSS data is not available, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA’s KEV catalog, indicating no known large‑scale public exploitation yet, but the presence of the bcrypt hash in the payload increases the value to attackers. Attackers likely need only a valid organization member account; once authenticated, the exploit can be performed with a simple HTTP request.