CVE-2026-91933: Flowise before 3.1.4 Authorization Bypass via openai-realtime
Flowise before 3.1.4 fails to enforce workspace-level authorization checks in openai-realtime endpoints, allowing authenticated users to access tools from ChatFlows in other workspaces by supplying an unscoped chatflowid. Attackers can invoke GET and POST requests to retrieve tool definitions and execute tools from victim workspaces, triggering external side effects and accessing sensitive tool outputs.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Flowise user with low privileges can exploit it. The attacker must be able to supply the identifier of a ChatFlow in another workspace.
What access can an attacker obtain through the affected endpoints?
An attacker can send GET and POST requests to the openai-realtime endpoints to retrieve tool definitions and execute tools belonging to ChatFlows in other workspaces. This can expose sensitive tool outputs and cause external side effects through the executed tools.
Which deployments are affected?
Flowise versions before 3.1.4 are affected. The issue concerns workspace-level authorization enforcement on openai-realtime endpoints.
How can defenders determine whether the issue may have been exploited?
Review requests to openai-realtime endpoints for GET or POST operations using chatflowid values that are not scoped to the requesting user's workspace. Investigate associated tool executions, external side effects, and access to sensitive tool outputs.