Flowise: Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI…
Flowise
More for Flowise RSS feed for Flowise
- Severity
- Critical, CVSS 9.9
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
- Record
- CVE-2026-67622
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 6, 2026
- Source last modified
- October 24, 2026
Description
Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownership verification. Attackers can enumerate cross-workspace assistant metadata, retrieve file and vector store listings, and upload files into victim workspaces by exploiting the missing workspace-scoped authorization check in the credential lookup logic.
Description quoted from the NVD record.
Who is affected
Flowise is a tool for building apps that use AI language models. This flaw affects Flowise versions through 3.1.4, in the part that connects Flowise to OpenAI's assistant service. Someone who already has a login to your Flowise setup could use saved credentials (stored login details) belonging to other workspaces (separate areas for different teams or projects), because Flowise does not check which workspace they belong to. That person could see details about other workspaces' assistants, list their files and stored document collections, and upload files into those workspaces. This flaw is rated Critical.
What to do
- If your organization installed and runs Flowise itself, the person who looks after it should check which version is in use. Versions through
3.1.4are affected. - No fixed version is named for this flaw yet, so check the vendor advisory linked on this page for a fixed release and install it as soon as one is available.
- If an IT provider or vendor runs Flowise for your organization, send them this advisory and ask when the update will be done.
Analysis written from the source record as of October 24, 2026 and reviewed before publishing.