Flowise Cross-Workspace Credential IDOR in OpenAI Assistants Vector Store API

Technical Analysis

The vulnerable route accepts a `credential` query parameter and passes it directly to a service function that performs `findOneBy({ id: credentialId })`, decrypts the stored OpenAI key, and executes API calls on behalf of the caller — with no `workspaceId` ownership check enforced. Route-level authorization only validates that the user has `assistants:*` feature permissions, not that the specific credential ID is scoped to their tenant. An attacker who enumerates or guesses another workspace's credential ID can trivially pivot their own agent session into using the victim's decrypted OpenAI credentials for vector store read/write/delete operations. This crosses the intended workspace isolation boundary in a multi-tenant agent platform, turning a tool-layer parameter into a tenant-boundary bypass with direct financial and data-confidentiality impact on the victim.

Affected Systems

Flowise

Detection Signatures

• GET/POST requests to /api/v1/openai-assistants-vector-store with a credential query parameter not owned by the requesting session's workspace
• Anomalous cross-workspace credentialId values appearing in request logs
• Unexpected OpenAI API billing/usage spikes correlated with vector store operations from unfamiliar workspace sessions
• Absence of workspaceId validation in credential lookup service logs

Remediation Steps

1. 1

   Enforce workspace-scoped credential checks

   Modify the credential lookup service to filter by both credentialId and the requesting user's workspaceId (e.g., findOneBy({ id: credentialId, workspaceId: req.user.workspaceId })) before decrypting or using any credential.

2. 2

   Upgrade Flowise

   Apply the vendor patch for GHSA-chm3-vqcf-52rx / CVE-2026-70472; upgrade beyond version 3.1.2 once a fixed release is available.

3. 3

   Add server-side authorization middleware

   Implement centralized ownership-verification middleware for all credential-consuming routes, not just permission/feature-flag checks, to prevent similar IDOR patterns across other endpoints.

4. 4

   Audit and rotate exposed credentials

   Rotate OpenAI API keys for any workspace credentials that may have been accessed via this flaw, and audit vector store contents/logs for unauthorized access or modification.

5. 5

   Implement anomaly monitoring

   Monitor for credential IDs used from sessions outside their owning workspace and alert on cross-tenant access patterns.