Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store
Summary
These endpoints accept a client-controlled credential parameter. The server loads credentials by id and uses them directly, without checking whether that credential belongs to the caller’s workspace. If an attacker knows another workspace’s credentialId, they can use that workspace’s OpenAI key.
Details
Route permissions (assistants:*) only check feature access. They do not check credential ownership. The controller passes req.query.credential straight to the service. The service does findOneBy({ id: credentialId }), decrypts the credential, and calls OpenAI APIs. There is no workspaceId check in this flow, so this is an IDOR.
Impact
- Cross-workspace unauthorized use of stored OpenAI keys.
- Unauthorized read/modify/delete of victim vector stores and files.
- Direct billing impact on victim OpenAI account.
- Multi-tenant boundary violation with practical exploitability.
Reproduction steps
- Set up two workspaces: A (attacker) and B (victim), each with an OpenAI credential.
- Log in as a user in workspace A (with assistants-related permissions).
- Call
/api/v1/openai-assistants-vector-storeand setcredentialto B’s credential ID. - Example:
GET /api/v1/openai-assistants-vector-store?credential=<B_credentialId>. - If responses/actions are executed using B’s credential context, the issue is confirmed.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | flowise | < 3.1.3 | 3.1.3 |
References
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-chm3-vqcf-52rx
- https://github.com/FlowiseAI/Flowise/pull/6170
- https://github.com/FlowiseAI/Flowise/commit/d81483b70c997ddf981acc9c49fbd9a02fa345cd
- https://github.com/FlowiseAI/Flowise
- https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:H/SA:H- Weakness (CWE)
CWE-285, CWE-863- Platform
- npm
- Package
flowise- Disclosed
- 04.08.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-chm3-vqcf-52rx - CC BY 4.0
Vulnerability history: flowise
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 114
- First → latest
- 04.2024 10.2026
- Without a fix
- 16
- Exploited in attacks
- 0
Severity breakdown
- Critical 28
- High 62
- Medium 24
Disclosures per year
- 2024: 11
- 2025: 22
- 2026: 81
-
Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.