CVE-2026-91933

Flowise versions before 3.1.4 fail to enforce workspace-level authorization checks on the openai-realtime endpoints, a CWE-639 user-controlled-key flaw. An authenticated attacker supplies an unscoped chatflowid belonging to another workspace, allowing them to send GET and POST requests that retrieve tool definitions and execute tools from victim workspaces. Successful exploitation can trigger external side effects (e.g., outbound actions performed by those tools) and expose sensitive tool outputs and configurations to users who should not have access. Any organization running a multi-tenant or multi-workspace Flowise deployment prior to 3.1.4 is affected, with CVSS 4.0 rated 7.6 (high). No public proof-of-concept is known and the flaw is not listed in the CISA KEV catalog, so exploitation status is currently none known.

What to do: Upgrade Flowise to version 3.1.4 or later, which enforces workspace-scoped authorization on the openai-realtime endpoints. Restrict Flowise instances to trusted networks or place them behind authenticated reverse proxies/VPNs, since the flaw requires only an authenticated low-privilege account. Audit logs for requests to openai-realtime endpoints referencing chatflowids outside the requester's workspace and review any tool executions or API keys in affected workspaces for misuse.