CVE-2026-90533

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.4

Description Broken access control in the 'GET /api/v1/organizationuser' endpoint allows any authenticated organization member to retrieve the full user record of the organization owner. This includes the bcrypt password hash and temporary tokens. By querying the endpoint with a specific user ID, an attacker can obtain the credential hash for offline cracking, potentially leading to a full account takeover of the most privileged account.

Recommendations Update to version 3.1.4 or later. Restrict access to the 'GET /api/v1/organizationuser' endpoint to prevent unauthorized retrieval of user records.