Executive brief
Flowise is a platform for building and managing conversational AI applications with multi-workspace support for team collaboration. An authentication bypass vulnerability allows authenticated users to access and execute tools from ChatFlows in other workspaces, potentially retrieving sensitive data, triggering unintended integrations, and compromising the isolation between workspaces.
Technical details
Flowise fails to enforce workspace-level authorization checks in the openai-realtime API endpoints (/api/v1/openai-realtime/:id). The vulnerability exists in packages/server/src/routes/openai-realtime/index.ts and packages/server/src/services/openai-realtime/index.ts, where the server loads a ChatFlow by ID without verifying that it belongs to the authenticated user's workspace. An authenticated attacker can supply an unscoped chatflowid from a victim workspace to both GET (tool disclosure) and POST (tool execution) endpoints, bypassing workspace isolation. The attack requires valid authentication within the same Flowise organization but no user interaction. Attackers can retrieve tool definitions, execute arbitrary tools, and access their outputs, including triggering external side effects through configured integrations. The fix is available in Flowise 3.1.4, which enforces strict workspace ownership validation before resolving and executing ChatFlows.
Affected products
- FlowiseAI Flowise before 3.1.4
Timeline
- 2026-08-31: disclosed: GitHub Security Advisory (GHSA-gggp-6qmf-xwwc) published
- 2026-09-15: advisory: CVE-2026-91933 published on NVD