Executive brief
Flowise is an open-source platform for building AI workflows and chatbots. A broken access control vulnerability allows any authenticated member of an organization to retrieve the organization owner's password hash and temporary tokens by querying a single API endpoint, without needing special permissions. An attacker could crack the password hash offline and take over the highest-privileged account, gaining complete control of the organization's data and settings.
Technical details
This is a broken access control vulnerability (CWE-862) in the GET /api/v1/organizationuser endpoint. The root cause is twofold: the GET route lacks authorization checks (checkPermission), unlike the POST/PUT/DELETE verbs on the same router, and the controller passes the requested userId directly to the service without scoping it to the requester's organization or scrubbing sensitive fields. Any authenticated user, even with the lowest-privilege "member" role with empty permissions, can query the endpoint with an arbitrary userId to retrieve the full User object of the organization owner, including the bcrypt credential hash, tempToken, and tokenExpiry fields. The attacker can then perform offline password cracking to compromise the owner account. The vulnerability was introduced as a separate issue from CVE-2025-58434 and affects versions before 3.1.4, which introduced the fix.
Affected products
- Flowise Flowise before 3.1.4
Timeline
- 2026-08-28: disclosed: GitHub Security Advisory GHSA-fhxm-xxcx-g6x3 published
- 2026-09-12: advisory: CVE-2026-90533 published on NVD