CVE-2026-90533

Flowise before version 3.1.4 contains a broken access control flaw (CWE-862) in the GET /api/v1/organizationuser API endpoint, which fails to verify that the requesting user is authorized to view another user's record. Any authenticated member of an organization can trigger the issue by querying the endpoint with an arbitrary user ID, retrieving the organization owner's full user object including the bcrypt password hash and temporary tokens. This enables an attacker to crack the owner's password offline and take over the highest-privileged account in the deployment, exposing all of that organization's workflows, API keys, and LLM credentials. All self-hosted Flowise instances running versions prior to 3.1.4 that use the organizations feature with multiple members are affected. Exploitation likelihood appears low for now: EPSS is 0.2% (9th percentile), the flaw is not in the CISA KEV catalog, and no in-the-wild attacks have been reported, though the flaw is publicly documented via a vendor security advisory.

What to do: Upgrade Flowise to version 3.1.4 or later, which fixes the missing authorization check on GET /api/v1/organizationuser. Rotate the organization owner's password and any temporary tokens, and audit server logs for requests to /api/v1/organizationuser made by non-owner organization members. Restrict network exposure of Flowise instances and enforce least-privilege organization membership until patched.