EUVD-2026-78791
GHSA-g5x4-4x4f-qgq9
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 15, 2026
Broken object-level authorization in Flowise's openai-realtime endpoints lets any authenticated user read tool definitions and execute tools belonging to ChatFlows in other workspaces by supplying an unscoped chatflowid, with both GET and POST requests affected. The flaw is fixed in Flowise 3.1.4 and affects all earlier releases; it is tracked as CWE-639 (authorization bypass through user-controlled key). No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS data was not supplied with this record, so risk should be judged from the authenticated-but-cross-tenant access model rather than from observed exploitation.
Earlier versions of this analysis (1)
Authorization bypass in FlowiseAI Flowise before 3.1.4 lets any authenticated user reach ChatFlow tools belonging to other workspaces by supplying an unscoped chatflowid to the openai-realtime endpoints. GET requests to those endpoints disclose tool definitions from victim workspaces, and POST requests invoke those tools, producing server-side side effects (outbound calls, data writes) and exposing sensitive tool outputs. The flaw is rated CVSS 7.1 (AV:N/AC:H/PR:L) and is an IDOR-class weakness (CWE-639); it is not listed in CISA KEV and no public exploit code was identified in the supplied intelligence, so exploitation is currently assessed as requiring a valid low-privileged account plus knowledge of a foreign workspace's chatflowid.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Flowise gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
Flowise before 3.1.4 fails to enforce workspace-level authorization checks in openai-realtime endpoints, allowing authenticated users to access tools from ChatFlows in other workspaces by supplying an unscoped chatflowid. Attackers can invoke GET and POST requests to retrieve tool definitions and execute tools from victim workspaces, triggering external side effects and accessing sensitive tool outputs.
Technical POC Analysis
Broken object-level authorization (primary CWE-639, authorization bypass through user-controlled key; the advisory also tags CWE-200 and CWE-862).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Flowise versions before 3.0.1 allow unauthenticated access to the Custom MCPs feature, which is designed to execute OS c
FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. Una
Arbitrary file read and write in Flowise versions prior to 3.0.8 allows an authenticated attacker with access to the flo
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Flowise is a drag & drop user interface to build a customized large language model flow. Rated critical severity (CVSS 9
Authenticated users can upload arbitrary files to Flowise 3.0.7 due to missing validation, enabling persistent storage o
Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthent
Missing authentication on NVD data endpoint in Flowise before 3.0.13 allows unauthenticated access to internal vulnerabi
Authenticated remote code execution in FlowiseAI Flowise (v3.0.1 up to but not including 3.0.8, and later versions when
Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDat
Remote code execution in FlowiseAI Flowise before 3.1.3 lets an attacker execute arbitrary OS commands as the Flowise pr
Exploit-DB