Executive brief
Flowise, a platform for building LLM-based applications, contains a vulnerability that allows users to view chatflow configurations belonging to other workspaces. An attacker with a valid API key can access sensitive information such as system prompts, workflow architectures, and internal configuration details of any chatflow that does not have an explicit API key assigned. This could lead to the exposure of intellectual property and internal service credentials across different organizational boundaries within the same Flowise instance.
Technical details
The `/api/v1/chatflows/apikey/:apikey` endpoint in Flowise fails to implement proper workspace isolation when querying for chatflows. The underlying service at `packages/server/src/services/chatflows/index.ts` constructs a database query that, by default, includes all records where the `apikeyid` is NULL or empty. Because the query lacks a `workspaceId` filter, an authenticated user with a valid API key for one workspace can retrieve the full `ChatFlow` entities (including `flowData`, `chatbotConfig`, and credential IDs) of unprotected chatflows from all other workspaces. This vulnerability is particularly impactful as chatflows are created without an API key by default. The issue is resolved in version 3.1.2.
Affected products
- FlowiseAI flowise <= 3.1.1
Timeline
- 2026-05-14: disclosed: Advisory published by researcher
- 2026-05-20: advisory: GitHub Advisory published
- 2026-05-20: patched: Fix released in version 3.1.2