EUVD-2026-52855
GHSA-wch5-xp77-fxg4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the prerequisite of knowing a victim credential UUID; PR:N applies to the more severe unauthenticated callback/refresh paths; no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flowise has three OAuth2 credential endpoints that look up credentials by id alone with no workspaceId filter. The authorize, callback, and refresh handlers query the Credential table by id only; callback and refresh are whitelisted from authentication. This allows any authenticated user to initiate OAuth2 flows against credentials belonging to other workspaces, allows an unauthenticated attacker to forge OAuth2 callbacks to overwrite tokens in any credential, and allows an unauthenticated attacker to refresh tokens for any credential. The affected routes include /api/v1/oauth2-credential/authorize/<VICTIM_CREDENTIAL_UUID>, /api/v1/oauth2-credential/callback?code=ATTACKER_AUTH_CODE&state=<VICTIM_CREDENTIAL_UUID>, and /api/v1/oauth2-credential/refresh/<VICTIM_CREDENTIAL_UUID>. This issue is fixed in version 3.1.3.
AnalysisAI
Cross-workspace OAuth2 credential isolation failure in Flowise prior to version 3.1.3 enables two distinct attack classes: authenticated users can initiate OAuth2 flows against credentials owned by other workspaces, and - more critically - unauthenticated attackers can forge OAuth2 callbacks to overwrite tokens or trigger token refreshes for any credential system-wide by exploiting a whitelist that bypasses all authentication on the /callback and /refresh endpoints. The root cause is that all three OAuth2 handlers query the Credential table by credential ID alone, omitting the workspaceId isolation enforced elsewhere in the codebase. No public exploit has been identified at time of analysis, and the issue is fixed in Flowise 3.1.3.
Technical ContextAI
Flowise (cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*) is an open-source Node.js/TypeScript LLM workflow builder distributed via npm. The vulnerability lives in packages/server/src/routes/oauth2/index.ts, where three handlers - authorize (line 80), callback (line 183), and refresh (line 314) - each call credentialRepository.findOneBy({ id: credentialId }) without a workspaceId predicate. The correct isolation pattern is demonstrated in the same codebase at packages/server/src/services/credentials/index.ts:130-132, which includes workspaceId in the query. Compounding the authorization flaw, the whitelist in packages/server/src/utils/constants.ts exports /api/v1/oauth2-credential/callback and /api/v1/oauth2-credential/refresh, and packages/server/src/index.ts:223-225 uses a prefix-match to bypass all JWT and API-key verification for these paths. CWE-863 (Incorrect Authorization) precisely describes the root cause: the system performs credential lookups without verifying that the requesting principal owns or is scoped to the target credential.
RemediationAI
Upgrade Flowise to version 3.1.3, the confirmed vendor-released patch per the GitHub release at https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3. The fix adds workspaceId scoping to all three OAuth2 credential handlers, consistent with the isolation pattern already used in the credentials service. For deployments that cannot immediately upgrade, a compensating control is to block external access to /api/v1/oauth2-credential/callback and /api/v1/oauth2-credential/refresh at the reverse proxy or WAF layer, which eliminates the unauthenticated token injection and refresh vectors; trade-off is that legitimate OAuth2 flows will break for all users until the patch is applied. Single-tenant self-hosted deployments with a single workspace have substantially lower practical risk, but the patch should still be applied since the authorize endpoint can leak credential metadata to any authenticated user. Refer to the security advisory at https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wch5-xp77-fxg4 for additional remediation guidance.
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Flowise versions before 3.0.1 allow unauthenticated access to the Custom MCPs feature, which is designed to execute OS c
FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. Una
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Flowise is a drag & drop user interface to build a customized large language model flow. Rated critical severity (CVSS 9
Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthent
Missing authentication on NVD data endpoint in Flowise before 3.0.13 allows unauthenticated access to internal vulnerabi
Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDat
Remote command execution in Flowise <= 3.1.2 lets an authenticated user break out of the vm2/@flowiseai/nodevm JavaScrip
Arbitrary file read and write in FlowiseAI Flowise (versions 2.2.8 through 3.0.5) lets remote unauthenticated attackers
Authenticated remote code execution in FlowiseAI Flowise prior to 3.1.2 allows any user with a valid session or API key
Remote code execution in Flowise before 3.1.3 lets authenticated users abuse the Custom MCP node - when CUSTOM_MCP_PROTO
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today