CVE-2026-70472

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3

Description Flowise contains an Insecure Direct Object Reference (IDOR) where the openai-assistants-vector-store endpoints accept a client-controlled credential parameter. The system loads credentials by id and uses them to call OpenAI APIs without verifying if the credential belongs to the caller's workspace. The controller passes the req.query.credential value to the service, which uses the findOneBy({ id: credentialId }) function to decrypt the credential. Because the assistants:* route permissions only verify feature access and not credential ownership, an attacker with a valid credentialId from another workspace can use that workspace's OpenAI key. This allows unauthorized reading, modification, or deletion of victim vector stores and files, causes billing impacts on the victim's OpenAI account, and violates multi-tenant boundaries.

Recommendations Update Flowise to version 3.1.3.