Critical Flowise IDOR Exposes Cross-Workspace OpenAI Assistant Credentials
Emerging Technology Risk · 3 sources · Updated 3mo ago · First seen Aug 6, 2026
A critical insecure direct object reference flaw, tracked as CVE-2026-67622, affects Flowise through version 3.1.4 and allows authenticated users to access resources tied to other workspaces in multi-tenant deployments. The bug resides in the OpenAI Assistants integration, where assistants-related endpoints accept an arbitrary credential UUID and resolve it without verifying that the credential belongs to the caller’s active workspace. The vulnerability is classified as CWE-639 and has been rated CVSS 9.9 under v3.1, with reporting also citing a CVSS 4.0 score of 8.5.
By supplying another workspace’s credential UUID, an attacker can cause Flowise to use a victim workspace’s OpenAI Assistants credential, enabling cross-workspace access to assistant metadata, file listings, and vector stores, and allowing file uploads into victim workspaces. The flaw also creates a path to unauthorized OpenAI API consumption and potential billing impact on affected accounts. Public reporting said no active exploitation had been observed at publication, and a vendor fix was expected in a future Flowise release.
