CVE-2026-67622 is an authorization bypass vulnerability in Flowise through version 3.1.4. The vulnerability exists in the OpenAI Assistants integration where the application fails to verify workspace ownership when processing credential UUIDs. Authenticated attackers can exploit this missing workspace-scoped authorization check to access credentials belonging to other workspaces, enumerate assistant metadata across workspaces, retrieve file and vector store listings, and upload files into victim workspaces. This is classified as CWE-639 (Authorization Bypass Through User-Controlled Key).

An attacker with authenticated access can access sensitive credentials from other workspaces, potentially leading to unauthorized data exposure. They can also enumerate metadata and file listings across workspaces and upload files into victim workspaces, which may lead to further compromise or data manipulation. The vulnerability has a high severity with a CVSS 4.0 score of 8.5, indicating significant impact if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to the minimum necessary and monitor for suspicious activity related to credential UUID usage. Avoid sharing credential UUIDs and consider additional access controls at the application layer.