Is CVE-2026-90533 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90533 being exploited in the wild.

How severe is CVE-2026-90533?

Medium severity, with a CVSS score of 6.5, published 12 September 2026.

Is there a fix for CVE-2026-90533?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-90533 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-90533?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90533: Flowise broken access control in GET /api/v1/organizationuser

CVE-2026-90533 · Severity: medium · CVSS 6.5 · Published 2026-09-12

Flowise is an open-source platform for building AI workflows and chatbots. A broken access control vulnerability allows any authenticated member of an organization to retrieve the organization owner's password hash and temporary tokens by querying a single API endpoint, without needing special permissions. An attacker could crack the password hash offline and take over the highest-privileged account, gaining complete control of the organization's data and settings.

Quick answers

Is CVE-2026-90533 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90533 being exploited in the wild.
How severe is CVE-2026-90533?: Medium severity, with a CVSS score of 6.5, published 12 September 2026.
Which products and versions are affected?: Flowise Flowise before 3.1.4.
Is there a fix for CVE-2026-90533?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-90533 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-90533?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a broken access control vulnerability (CWE-862) in the GET /api/v1/organizationuser endpoint. The root cause is twofold: the GET route lacks authorization checks (checkPermission), unlike the POST/PUT/DELETE verbs on the same router, and the controller passes the requested userId directly to the service without scoping it to the requester's organization or scrubbing sensitive fields. Any authenticated user, even with the lowest-privilege "member" role with empty permissions, can query the endpoint with an arbitrary userId to retrieve the full User object of the organization owner, including the bcrypt credential hash, tempToken, and tokenExpiry fields. The attacker can then perform offline password cracking to compromise the owner account. The vulnerability was introduced as a separate issue from CVE-2025-58434 and affects versions before 3.1.4, which introduced the fix.

Affected products

Flowise Flowise before 3.1.4

Timeline

2026-08-28: disclosed: GitHub Security Advisory GHSA-fhxm-xxcx-g6x3 published
2026-09-12: advisory: CVE-2026-90533 published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.