CVE-2026-91930

Flowise before 3.1.4 fails to scope its enterprise organization and workspace membership APIs (organizationuser and workspace endpoints) to the caller's tenant, meaning authorization checks do not verify that the requester belongs to the targeted organization. An authenticated user of any tenant can trigger the flaw by simply supplying an arbitrary organization ID in requests to these endpoints. Successful exploitation lets the attacker add themselves as an organization owner, create new workspaces, and gain administrative access to victim organizations, exposing that organization's chatflows, credentials, and API keys stored in Flowise. Only deployments running the enterprise multi-tenant features (organizations/workspaces) on Flowise versions before 3.1.4 are affected. There is no known public proof of concept, the CVE is not in CISA's KEV, and no exploitation in the wild has been reported.

What to do: Upgrade Flowise to version 3.1.4 or later, which scopes the organizationuser and workspace endpoints to the caller's tenant. Until patched, ensure Flowise instances are not directly internet-exposed (place behind VPN or an authenticating reverse proxy) and restrict who holds authenticated accounts on multi-tenant deployments. Review audit logs for unexpected organization role assignments, new owners, or workspace creations across tenants, and rotate any credentials or LLM API keys stored in affected organizations if anomalies are found.