FlowiseAI Flowise before version 3.1.3 has an authorization flaw in the openai-assistants-vector-store endpoints. These endpoints accept a credential parameter controlled by the client and load credentials by ID without verifying that the credential belongs to the caller's workspace. The route permissions only check feature access but do not enforce workspace ownership. The service decrypts and uses the credential to call OpenAI APIs without a workspaceId check. An attacker who knows another workspace's credential ID can misuse that workspace's OpenAI key, read, modify, or delete vector stores and files, causing unauthorized actions and billing impact. The issue is resolved in Flowise version 3.1.3.

An attacker with knowledge of another workspace's credential ID can bypass authorization controls to use that workspace's OpenAI API key. This can result in unauthorized reading, modification, or deletion of vector stores and files belonging to the victim workspace. Additionally, the attacker can cause billing charges on the victim's OpenAI account. The vulnerability breaks multi-tenant isolation, potentially compromising data confidentiality and integrity within Flowise deployments.

This vulnerability is fixed in Flowise version 3.1.3. Users should upgrade to version 3.1.3 or later to remediate this issue. There is no indication of alternative mitigations or temporary fixes. Patch status is confirmed by the vendor advisory stating the fix in 3.1.3.