CVE-2026-67622

Flowise, an open-source drag-and-drop LLM application builder, contains an insecure direct object reference (CWE-639) in its OpenAI Assistants integration in versions through 3.1.4. An authenticated attacker triggers the flaw by supplying an arbitrary credential UUID to Assistants endpoints; the credential lookup logic never verifies that the requesting user's workspace owns that credential. Successful exploitation lets the attacker use credentials belonging to other workspaces, enumerate cross-workspace assistant metadata, retrieve file and vector store listings from victim workspaces, and upload files into those victims' workspaces. All self-hosted and multi-tenant Flowise deployments up to and including version 3.1.4 are affected, particularly those where multiple users or organizations share an instance. The flaw is rated high severity (CVSS 4.0: 8.5) due to the cross-tenant confidentiality and integrity impact, but exploitation probability in the next 30 days is currently assessed as low (EPSS 0.2%) with no confirmed in-the-wild attacks; a public proof-of-concept advisory does exist.

What to do: Upgrade Flowise to a release newer than 3.1.4 as soon as a patched version is available; until then, place Flowise behind a VPN or IP allowlist and restrict authenticated access to trusted users only, especially on multi-user or shared instances. Rotate any OpenAI (and other) API keys stored as Flowise credentials, since other workspaces' credentials could have been abused. Review audit and access logs for suspicious credential UUID usage, unexpected file uploads, and anomalous assistant, file, or vector store listing requests across workspaces.