Broken Access Control in Flowise Exposes Owner Credentials

Executive Summary

CVE-2026-90533 is a broken access control vulnerability in Flowise versions 3.1.3 and earlier. It affects the GET /api/v1/organizationuser endpoint, allowing any authenticated organization member to retrieve the owner's full user record, including bcrypt password hash and temporary tokens. The flaw occurs because the endpoint lacks proper permission checks and does not scrub sensitive fields like the password hash.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Flowise instance is running a version before 3.1.4. Use commands like 'curl -X GET http://<target>/api/v1/organizationuser?userId=<any_user_id>' to test if the endpoint returns sensitive data such as bcrypt password hashes or tokens.

Useful 0 Not Useful 0

Impact Analysis

An attacker with low-privilege access can exploit this to obtain the organization owner's password hash. They can then crack the hash offline to gain full control of the highest-privileged account. This enables complete takeover of the organization's Flowise instance, including access to all data and functions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. It may result in data breaches, unauthorized disclosure of personal or health information, and failure to maintain confidentiality and integrity of sensitive records.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Flowise to version 3.1.4 or later. If upgrading is not possible, restrict access to the /api/v1/organizationuser endpoint and implement proper authentication and authorization checks to prevent unauthorized access to sensitive user records.

Useful 0 Not Useful 0