Which versions of Flowise are affected by CVE-2026-67622?

Flowise through version 3.1.4 contains an authorization flaw in its OpenAI Assistants integration that allows any authenticated user to steal credentials and access data owned by other workspaces.

Is there a public PoC exploit available for CVE-2026-67622?

Yes, a public proof-of-concept exploit is available for CVE-2026-67622. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-67622?

Within 24 hours, disable the OpenAI Assistants integration in Flowise or restrict access exclusively to administrative users. Within 7 days, identify and begin evaluation of alternative AI orchestration platforms with active security maintenance; if Flowise upgrade is available, confirm it addresses the cross-workspace authorization control before deployment. Within 30 days, execute either full migration away from Flowise or redeploy remaining instances as isolated single-tenant systems with no credential sharing between workspaces.

Flowise CVE-2026-67622

Q: What is the CVSS score of CVE-2026-67622?

CVE-2026-67622 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-54171 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-06 disclosure@vulncheck.com

GHSA-qvmw-v4w9-7c4j

Authentication Bypass Flowise Flowiseai

8.5

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.5 HIGH

Network-reachable IDOR requiring authenticated low-privileged user; scope changed because victim workspaces are affected; integrity rated Low for unauthorized file uploads, no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 22:47 vuln.today

CVE Published

Aug 06, 2026 - 22:18 cve.org

HIGH 8.5

DescriptionCVE.org

Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownership verification. Attackers can enumerate cross-workspace assistant metadata, retrieve file and vector store listings, and upload files into victim workspaces by exploiting the missing workspace-scoped authorization check in the credential lookup logic.

AnalysisAI

Cross-workspace credential theft in Flowise through 3.1.4 exploits a missing workspace-scoped authorization check in the OpenAI Assistants integration, enabling authenticated users to access credentials owned by unrelated workspaces by supplying arbitrary credential UUIDs. The flaw exposes multi-tenant deployments: an attacker with any valid account can enumerate assistant metadata, retrieve file and vector store listings, and write files into victim workspaces without owning or having delegated access to the target workspace. No KEV listing at time of analysis, but a public advisory exists; the product appears to have entered sunset, potentially leaving the vulnerability unpatched.

Technical ContextAI

Flowise is an open-source drag-and-drop LLM orchestration platform. Its OpenAI Assistants integration exposes API endpoints that accept a credential UUID to identify which OpenAI API key to use for assistant operations. CWE-639 (Authorization Bypass Through User-Controlled Key) describes the root cause precisely: the server resolves the credential record by UUID supplied in the request without verifying that the resolved credential belongs to the requesting user's workspace. In a multi-tenant Flowise deployment, workspace isolation is the primary authorization boundary; bypassing it via an unchecked user-controlled identifier allows lateral movement between tenants. The UUID-based enumeration surface is typical of systems that use non-sequential GUIDs as object keys - while UUIDs are not trivially guessable, they can be obtained through other means (log leaks, shared UI state, or iterative probing if version 4 UUIDs with weak entropy are used).

RemediationAI

Primary fix: No vendor-released patched version has been identified at time of analysis. The reference to flowiseai.com/sunset suggests the product may be discontinued, meaning a vendor patch may not be forthcoming - operators should treat this as a permanent risk requiring migration or compensating controls. Immediate compensating controls for active deployments include: restricting Flowise to single-tenant mode or disabling multi-workspace functionality to eliminate cross-workspace enumeration risk; placing Flowise behind an authentication proxy that enforces workspace-scoped session claims before requests reach the Assistants endpoints; and rotating all OpenAI API credentials stored in Flowise workspaces, as any may have been accessed by other workspace members. If migration away from Flowise is not immediately feasible, audit Flowise access logs for requests to Assistants endpoints containing credential UUIDs belonging to other workspaces. The public advisory at https://github.com/Caycon/cve-advisories/blob/main/2026/Flowise/CVE-2026-67622.md should be reviewed for researcher-provided technical detail and any workaround suggestions.