Executive Summary

This vulnerability exists in FlowiseAI Flowise up to version 3.0.12, specifically in the User Controller Handler component. It involves manipulation of certain arguments such as userId, organizationId, workspaceId, or email, which leads to an authorization bypass. This means an attacker can remotely exploit this weakness to gain unauthorized access or privileges.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an attacker to bypass authorization controls remotely by manipulating specific user-related arguments. This could result in unauthorized access to user accounts, organizational data, or workspace information, potentially compromising sensitive information or allowing actions that should be restricted.

Useful 0 Not Useful 0

Mitigation Strategies

The affected component should be upgraded to a version later than FlowiseAI Flowise 3.0.12 to mitigate this vulnerability.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthorized cross-tenant data access by bypassing authorization checks, enabling attackers to read arbitrary user profiles and organizational data across tenants. Such unauthorized access to sensitive personal and organizational information can lead to violations of data protection regulations like GDPR and HIPAA, which mandate strict controls on access to personal and health-related data.

Specifically, the ability to enumerate users, organization memberships, and workspace structures without proper authorization increases the risk of data breaches and unauthorized disclosure of personal data, which can result in non-compliance with privacy and security requirements imposed by these standards.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the affected Flowise API endpoints for unauthorized access to user, organization, and workspace data. Specifically, the GET endpoints /api/v1/user, /api/v1/organizationuser, and /api/v1/workspaceuser should be checked to see if they allow data enumeration without proper authorization.

To detect the vulnerability, you can attempt to send authenticated GET requests with manipulated query parameters such as userId, email, or organizationId to these endpoints and observe if the responses include data from other users or organizations that should not be accessible.

Example commands using curl to test these endpoints might be:

• curl -i -H "Authorization: Bearer <token>" "http://<flowise-host>/api/v1/user?userId=someUserId"
• curl -i -H "Authorization: Bearer <token>" "http://<flowise-host>/api/v1/organizationuser?organizationId=someOrgId"
• curl -i -H "Authorization: Bearer <token>" "http://<flowise-host>/api/v1/workspaceuser?workspaceId=someWorkspaceId"

If these requests return data for users, organizations, or workspaces outside the authenticated user's scope, it indicates the presence of the authorization bypass vulnerability.

Useful 0 Not Useful 0