The vulnerability is an IDOR in the Flowise API endpoint POST /api/v1/node-load-method/:name. The endpoint lacks a permission check and uses a user supplied credential ID without verifying that the credential belongs to the user's current workspace. This allows an authenticated low‑privilege user or a workspace API key in one workspace to provide the ID of a credential owned by another workspace. The server then decrypts that credential and uses it to perform third‑party provider calls such as Google Drive listFiles, Google Sheets listSpreadsheets, or AWS DynamoDB KV Storage listTables, returning the provider metadata to the attacker. The attacker never receives the raw credential secret itself, but can abuse the credential to retrieve resource metadata from the affected workspace's third‑party services. The weakness is described by CWE‑639.

The affected product is FlowiseAI Flowise, a low‑code LLM application builder. Versions up to and including 3.1.3 contain the flaw, while version 3.1.4 and later have a fix that validates the credential's workspaceId. The CVE applies to Flowise deployments where the node-load-method endpoint is exposed and the application is configured to use cross‑workspace credentials.

The CVSS score of 6.1 indicates a medium impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploitation yet. The attack requires authenticated access to the Flowise API and knowledge of another workspace’s credential ID. With those prerequisites, the attacker can cause the application to act as a confused deputy and retrieve external service metadata, potentially exposing sensitive workspace‑level data. Network‑based attackers who can reach the Flowise host and obtain a user API key, or a user with low privileges, are at risk. The lack of a restriction on the node‑load‑method route makes the flaw exploitable in any environment that exposes this endpoint.