CVE-2026-100609: Flowise through 3.1.4 Insecure Direct Object Reference via Credential
Flowise (npm packages flowise and flowise-components) through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace (findOneBy({ id: credentialId }) with no workspaceId condition) in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant (GET /api/v1/openai-assistants and /api/v1/openai-assistants/:id), uploadFilesToAssistant (POST /api/v1/openai-assistants-file/upload/), deleteAssistant (DELETE /api/v1/assistants/:id, reachable by first importing a poisoned assistant row via POST /api/v1/export-import/import), and the shared helper used by getVoices (GET /api/v1/text-to-speech/voices). An authenticated user of one workspace can supply a credential UUID belonging to another workspace, causing the server to decrypt and use that workspace's OpenAI or ElevenLabs API key on the attacker's behalf. No patched version was available at the time of publication.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed?
Deployments with multiple workspaces are exposed when credentials belonging to one workspace can be referenced by an authenticated user in another workspace. The affected packages are flowise and flowise-components through 3.1.4.
What does an attacker need to exploit this?
The attacker needs an authenticated account in a workspace and a credential UUID belonging to a different workspace. They can then provide that UUID to an affected API path, causing the server to decrypt and use the other workspace's OpenAI or ElevenLabs key.
Which API paths should be prioritized for review or restriction?
The identified paths are GET /api/v1/openai-assistants, GET /api/v1/openai-assistants/:id, POST /api/v1/openai-assistants-file/upload/, DELETE /api/v1/assistants/:id after importing a poisoned assistant row through POST /api/v1/export-import/import, and GET /api/v1/text-to-speech/voices.
Is a patched release available?
No patched version was available at the time of publication.