Flowise Cross-Workspace Credential IDOR via OpenAI Assistants Integration

Technical Analysis

The vulnerability is an insecure direct object reference (IDOR) in Flowise's credential lookup logic for OpenAI Assistants endpoints: the backend accepts an arbitrary credential UUID and resolves it without checking that the UUID belongs to the requesting user's workspace. An authenticated attacker (low privilege) can enumerate or guess credential UUIDs to retrieve API keys/secrets, list assistant metadata, files, and vector stores from other tenants, and write files into victim workspaces. Because credentials in Flowise are frequently used to authorize downstream LLM/tool calls, this breaks the workspace trust boundary and effectively grants cross-tenant control over agent configurations and connected AI resources. The entry point is a standard authenticated API call to Assistants-related REST endpoints; no additional exploitation chain is required beyond supplying a foreign UUID.

Affected Systems

Flowise

Detection Signatures

• Log pattern: requests to /api/v1/*assistants*/credential or similar endpoints with credential UUIDs not owned by the authenticated user's workspace
• Anomalous cross-workspace access: single user account querying many distinct credential UUIDs in short succession
• Unexpected file uploads into workspaces from users without prior association to that workspace
• API access logs showing 200 OK responses for credential/assistant lookups lacking workspace_id/tenant_id correlation checks

Remediation Steps

1. 1

   Upgrade Flowise

   Update to a patched Flowise version beyond 3.1.4 once available that enforces workspace-scoped authorization on credential and Assistants endpoints.

2. 2

   Enforce server-side workspace ownership checks

   Add mandatory validation that any credential UUID, assistant ID, file, or vector store reference belongs to the authenticated user's current workspace before returning or acting on data.

3. 3

   Rotate exposed credentials

   Rotate all OpenAI and third-party API credentials stored in Flowise, as they may have been exposed to unauthorized workspaces.

4. 4

   Audit access logs

   Review historical API logs for cross-workspace credential/assistant access patterns to identify potential prior exploitation.

5. 5

   Apply least-privilege multi-tenancy design

   Implement tenant isolation at the data-access layer (e.g., row-level security or mandatory tenant filters in ORM queries) rather than relying solely on application logic.