Executive brief
Flowise, an open-source tool for building LLM applications, is vulnerable to an authorization flaw that allows users in one workspace to access credentials belonging to another workspace. By providing a specific ID, an attacker can use a victim's OpenAI API keys, leading to unauthorized data access and unexpected billing charges on the victim's account. This compromises the security boundaries between different teams or customers using the same Flowise instance.
Technical details
An Insecure Direct Object Reference (IDOR) exists in Flowise versions 3.1.2 and earlier within the `openai-assistants-vector-store` component. The application fails to validate workspace ownership when loading credentials via the `credential` parameter in API requests. An authenticated attacker can supply a `credentialId` belonging to a different workspace to the `/api/v1/openai-assistants-vector-store` endpoint. The server then retrieves and uses the associated OpenAI API key without verifying if the caller has permission to access that specific workspace's resources. This allows for unauthorized read/modify/delete operations on vector stores and files, as well as unauthorized use of the victim's OpenAI quota. The issue is fixed in version 3.1.3.
Affected products
- FlowiseAI Flowise <= 3.1.2
Timeline
- 2026-07-29: patched: Fixed in version 3.1.3
- 2026-08-04: disclosed: GitHub Advisory published