Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store
Flowise
More for Flowise RSS feed for Flowise
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-70472
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 4, 2026
- Source last modified
- October 24, 2026
Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise openai-assistants-vector-store endpoints accept a client-controlled credential parameter and load credentials by id without checking whether that credential belongs to the caller workspace. Route permissions assistants:* only check feature access. The controller passes req.query.credential straight to the service, and the service uses findOneBy({ id: credentialId }), decrypts the credential, and calls OpenAI APIs without a workspaceId check. If an attacker knows another workspace credentialId, the attacker can use that workspace OpenAI key, read, modify, or delete victim vector stores and files, cause billing impact on the victim OpenAI account, and violate multi-tenant boundaries. This issue is fixed in version 3.1.3.
Description quoted from the NVD record.
Who is affected
Flowise is a drag-and-drop tool for building apps that use AI language models. This flaw affects versions before 3.1.3 and is in the part of Flowise that manages OpenAI assistant file stores (collections of files an AI assistant can search). Flowise does not check that a saved OpenAI credential belongs to the workspace of the person using it. A user in one workspace who knows the identifier of another workspace's saved OpenAI credential could use that workspace's OpenAI key. They could also read, change or delete its stored files, run up charges on its OpenAI account, and break the separation between workspaces. This flaw is rated High.
What to do
- The person who installed or runs Flowise for your organization should check which version is in use. If it is older than
3.1.3, this flaw applies. - Update Flowise to version
3.1.3or later, which fixes this flaw. - If an IT provider or vendor runs Flowise for your organization, send them this advisory and ask when the update will be done.
- After updating, check that Flowise shows version
3.1.3or later so you know the fix is in place.
Analysis written from the source record as of October 24, 2026 and reviewed before publishing.