FlowiseAI Flowise up to and including version 3.1.3 has a flaw in the POST /api/v1/node-load-method/:name endpoint, which is mounted without route-level permission checks. This endpoint invokes component loadMethods with attacker-controlled parameters including nodeName, loadMethod, inputs, and credential ID. Credential resolution via getCredentialData() decrypts credentials without verifying that the Credential.workspaceId matches the caller's workspace, unlike other credential read paths that enforce workspace scoping. Consequently, an authenticated low-privilege user or workspace API key can supply a credential ID from another workspace, causing Flowise to act as a confused deputy by making third-party provider calls (e.g., Google Drive listFiles, Google Sheets listSpreadsheets, AWS DynamoDB listTables) with the victim's credentials and returning provider metadata to the attacker. The raw credential secret is not returned. The vulnerability is addressed in Flowise version 3.1.4.

An attacker with low-privilege authentication or a workspace API key can bypass authorization controls to use credentials from other workspaces. This allows the attacker to make third-party service calls on behalf of the victim workspace, potentially exposing provider metadata. The raw credential secrets are not disclosed, but the misuse of credentials can lead to unauthorized actions and data exposure via third-party integrations.

This vulnerability is fixed in Flowise version 3.1.4. Users should upgrade to version 3.1.4 or later to remediate this issue. Since Flowise is a cloud service, the vendor manages remediation for the cloud-hosted service; verify with the vendor advisory that the service is updated accordingly.