Executive brief
Flowise is a multi-tenant AI workflow platform used by organizations to build and manage AI applications. A critical vulnerability allows authenticated users from one organization to add themselves as administrators of victim organizations, take over workspaces, and access confidential data or workflows belonging to other tenants. This breaks tenant isolation and enables complete account takeover of other organizations.
Technical details
This is an authorization bypass vulnerability stemming from missing tenant-scope validation in the organization-user and workspace membership endpoints. The vulnerable endpoints (POST /api/v1/organizationuser and POST /api/v1/workspace) check only that the caller has local permissions (users:manage or workspace:create) within their own organization, then blindly accept attacker-supplied organizationId values without verifying the caller belongs to that organization. An authenticated attacker can exploit this by (1) posting to /api/v1/organizationuser with a victim's organizationId and the global owner roleId to add themselves as an owner, (2) creating a workspace in that victim organization, and (3) switching into that workspace to receive isOrganizationAdmin: true, thereby bypassing all downstream permission checks. The vulnerability affects Flowise before version 3.1.4 and is patched in 3.1.4 and later.
Affected products
- Flowise Flowise before 3.1.4
Timeline
- 2026-08-31: disclosed: Security advisory published on GitHub
- 2026-09-15: advisory: CVE-2026-91930 published on NVD
- 2026: patched: Fixed in version 3.1.4