CVE-2026-67622

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.5

Description An insecure direct object reference (IDOR) occurs in the OpenAI Assistants integration. This issue allows authenticated attackers to access credentials from other workspaces by providing an arbitrary credential UUID to Assistants endpoints, as the system fails to verify workspace ownership. By exploiting the missing workspace-scoped authorization check in the credential lookup logic, attackers can enumerate assistant metadata across workspaces, retrieve listings for files and vector stores, and upload files into victim workspaces.

Recommendations Update to version 3.1.5 or later.