CVE-2026-67622

Received Received - Intake

Flowise OpenAI Assistants Credential Access via Insecure Direct Object Reference

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: VulnCheck

Description

Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownership verification. Attackers can enumerate cross-workspace assistant metadata, retrieve file and vector store listings, and upload files into victim workspaces by exploiting the missing workspace-scoped authorization check in the credential lookup logic.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-67622

Affected Vendors & Products

Vendor	Product	Version / Range
flowise	flowise	3.1.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an insecure direct object reference in Flowise version 3.1.4. It allows authenticated attackers to access credentials belonging to other workspaces by providing an arbitrary credential UUID to Assistants endpoints. The issue arises because the system does not verify workspace ownership when retrieving credentials.

Impact Analysis

Attackers can exploit this to enumerate cross-workspace assistant metadata, retrieve file and vector store listings, and upload files into victim workspaces. This could lead to unauthorized access to sensitive data, data leakage, or further compromise of workspace resources.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in non-compliance, legal penalties, and reputational damage due to data breaches.

Mitigation Strategies

Upgrade Flowise to a version later than 3.1.4 where the insecure direct object reference vulnerability has been patched. Ensure all workspaces are reviewed for unauthorized access or modifications. Implement strict workspace-scoped authorization checks for credential access and assistant endpoints.

Hi! I’m here to help you understand CVE-2026-67622. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70