CVE-2026-90533: Flowise before 3.1.4 Broken Access Control via organizationuser
Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser that allows any authenticated organization member to retrieve the organization owner's full user record including bcrypt password hash and temporary tokens. Attackers can query the endpoint with any user ID to obtain the owner's credential hash for offline cracking, enabling account takeover of the highest-privileged account.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Flowiseto a version that resolves this vulnerability.Fixed in 3.1.4 - Compensating control
As a compensating control until upgraded, restrict access to GET /api/v1/organizationuser so that only the organization owner (or equivalent least-privileged role) can retrieve the organization owner's full user record, including bcrypt password hash and temporary tokens.
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated member of an organization can exploit it. The attacker does not need to be the organization owner or otherwise hold elevated privileges.
What information can be obtained, and why is it high impact?
The endpoint can return the organization owner’s full user record, including a bcrypt password hash and temporary tokens. The hash can be cracked offline, potentially allowing takeover of the highest-privileged account.
What request capability does an attacker need?
The attacker needs authenticated access as an organization member and the ability to query GET /api/v1/organizationuser with a user ID. The issue allows queries using any user ID.
Which versions are affected?
Flowise versions before 3.1.4 are affected. Upgrading to 3.1.4 or later addresses the vulnerable version range.