CVE-2026-91933
Flowise before 3.1.4 fails to enforce workspace-level authorization checks in openai-realtime endpoints, allowing authenticated users to access tools from ChatFlows in other workspaces by supplying an unscoped chatflowid. Attackers can invoke GET and POST requests to retrieve tool definitions and execute tools from victim workspaces, triggering external side effects and accessing sensitive tool outputs.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.6
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
- CWE
- CWE-639
- Published
- 2026-09-15
- Last modified
- 2026-09-15
Affected products
- FlowiseAI Flowise
- FlowiseAI Flowise
Weakness type
Related vulnerabilities
- CVE-2026-16310 — MemberDash <= 1.8.5 - Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameter
- CVE-2026-53552 — Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers
- CVE-2026-9812 — Missing property field ownership validation in Playbooks run property update endpoint
- CVE-2026-88877 — Traefik v3.7.0 Authentication Bypass via from-to-www-redirect
- CVE-2026-47156 — MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator
- CVE-2026-84148 — Insecure Direct Object Reference Vulnerability in Manacle Technologies ERP System
- CVE-2026-82441 — Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys
- CVE-2026-82281 — Kotaemon Missing Ownership Check in Conversation Functions