CVE-2026-67622 is an insecure direct object reference vulnerability (CWE-639) in Flowise through version 3.1.4. The flaw exists in the OpenAI Assistants integration where the credential lookup logic lacks workspace ownership verification. Authenticated attackers can provide arbitrary credential UUIDs to Assistants endpoints, enabling them to access credentials belonging to other workspaces. This leads to unauthorized enumeration of cross-workspace assistant metadata, access to file and vector store listings, and the ability to upload files into victim workspaces. The vulnerability arises from missing workspace-scoped authorization checks in the credential handling process.

The vulnerability allows authenticated users to bypass authorization controls and access sensitive credentials and metadata from other workspaces. This can lead to unauthorized data exposure and potential manipulation of victim workspace contents by uploading files. The CVSS 4.0 score of 8.5 indicates a high severity impact with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been published at this time. Until a patch is available, restrict authenticated user permissions and monitor for suspicious activity related to credential UUID enumeration and unauthorized file uploads.