CVE-2026-100609: Authorization Bypass Through User-Controlled Key in FlowiseAI Flowise
Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace (findOneBy({ id: credentialId }) with no workspaceId condition) in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant (GET /api/v1/openai-assistants and /api/v1/openai-assistants/:id), uploadFilesToAssistant (POST /api/v1/openai-assistants-file/upload/), deleteAssistant (DELETE /api/v1/assistants/:id, reachable by first importing a poisoned assistant row via POST /api/v1/export-import/import), and the shared helper used by getVoices (GET /api/v1/text-to-speech/voices). An authenticated user of one workspace can supply a credential UUID belonging to another workspace, causing the server to decrypt and use that workspace's OpenAI or ElevenLabs API key on the attacker's behalf. No patched version was available at the time of publication.
AI Analysis
Technical Summary
Flowise versions up to 3.1.4 perform credential lookups by ID without verifying that the credential belongs to the requesting user's workspace. Several API endpoints (including getAllOpenaiAssistants, getSingleOpenaiAssistant, uploadFilesToAssistant, deleteAssistant, and getVoices) use findOneBy({ id: credentialId }) without a workspaceId condition. This allows an authenticated user to supply a credential UUID from another workspace, causing the server to decrypt and use that workspace's API keys on the attacker's behalf. No official fix or patch was available at the time of disclosure.
Potential Impact
An attacker authenticated in one workspace can access and use API credentials from other workspaces without authorization. This compromises the confidentiality of API keys and may allow unauthorized API usage under another workspace's identity. The vulnerability has a high severity score (CVSS 7.6) due to the potential for significant unauthorized access and misuse of sensitive credentials.
Mitigation Recommendations
No official patch or fix was available at the time of publication. Users should monitor vendor advisories for updates. Until a fix is released, restrict access to trusted users only and consider isolating workspaces or credentials to minimize risk. Avoid exposing credential UUIDs across workspace boundaries.
CVE-2026-100609: Authorization Bypass Through User-Controlled Key in FlowiseAI Flowise
Description
Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace (findOneBy({ id: credentialId }) with no workspaceId condition) in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant (GET /api/v1/openai-assistants and /api/v1/openai-assistants/:id), uploadFilesToAssistant (POST /api/v1/openai-assistants-file/upload/), deleteAssistant (DELETE /api/v1/assistants/:id, reachable by first importing a poisoned assistant row via POST /api/v1/export-import/import), and the shared helper used by getVoices (GET /api/v1/text-to-speech/voices). An authenticated user of one workspace can supply a credential UUID belonging to another workspace, causing the server to decrypt and use that workspace's OpenAI or ElevenLabs API key on the attacker's behalf. No patched version was available at the time of publication.
CVSS v4.0
Score 7.6high
Affected software
FlowiseAI
Flowise
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Flowise versions up to 3.1.4 perform credential lookups by ID without verifying that the credential belongs to the requesting user's workspace. Several API endpoints (including getAllOpenaiAssistants, getSingleOpenaiAssistant, uploadFilesToAssistant, deleteAssistant, and getVoices) use findOneBy({ id: credentialId }) without a workspaceId condition. This allows an authenticated user to supply a credential UUID from another workspace, causing the server to decrypt and use that workspace's API keys on the attacker's behalf. No official fix or patch was available at the time of disclosure.
Potential Impact
An attacker authenticated in one workspace can access and use API credentials from other workspaces without authorization. This compromises the confidentiality of API keys and may allow unauthorized API usage under another workspace's identity. The vulnerability has a high severity score (CVSS 7.6) due to the potential for significant unauthorized access and misuse of sensitive credentials.
Mitigation Recommendations
No official patch or fix was available at the time of publication. Users should monitor vendor advisories for updates. Until a fix is released, restrict access to trusted users only and consider isolating workspaces or credentials to minimize risk. Avoid exposing credential UUIDs across workspace boundaries.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-26T02:30:34.352Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab7c99ff7a7c5410652fca5
Added to database: 09/26/2026, 13:33:19 UTC
Last enriched: 09/26/2026, 14:19:14 UTC
Last updated: 09/27/2026, 01:57:11 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.