C4Tzzz

Authenticated users can access tools from ChatFlows in other workspaces due to a failure to enforce workspace-level authorization checks in the `openai-realtime` endpoints. By providing an unscoped `chatflowid` variable, an attacker can use GET and POST requests to retrieve tool definitions and execute tools from victim workspaces, which may lead to external side effects and the exposure of sensitive tool outputs. This issue has been exploited in real-world incidents.

The POST '/api/v1/node-load-method/:name' endpoint lacks route-level permission checks and allows the invocation of component loadMethods using attacker-controlled `nodeName`, `loadMethod`, `inputs`, and credential values. The system resolves the selected credential via `getCredentialData()` using the raw `Credential.id` and decrypts it without verifying the `Credential.workspaceId` against the caller's active or shared workspace. This allows an authenticated low-privilege user or a workspace API key from one workspace to provide a credential ID belonging to another workspace. Consequently, the application acts as a confused deputy, executing third-party provider calls using the victim workspace's credentials and returning provider metadata to the attacker. Affected load methods include Google Drive listFiles, Google Sheets listSpreadsheets, and AWS DynamoDB KV Storage listTables. The raw credential secret is not exposed. A confused deputy is a security issue where a privileged entity is tricked by a less privileged entity into performing an action on its behalf.

An issue exists where a mobile device token created in single-user mode remains valid after migration to multi-user mode, even if the device record has `userId` set to null. The mobile authentication middleware continues to accept this stale token. Since no user is associated with the request, mobile handlers use unscoped data-access branches, returning workspaces and content without per-user filtering. This allows a pre-migration token to enumerate workspaces assigned to other users and retrieve thread metadata and chat content.

An insecure direct object reference (IDOR) exists in the text-to-speech endpoint. The endpoint "/api/workspace/:slug/tts/:chatId" validates workspace membership but fails to enforce ownership of the targeted chat row. This allows an authenticated user to access another user's private assistant response in audio form if the `chatId` is known or guessed.