{"id":"GHSA-chm3-vqcf-52rx","revision":"890a1b0c032b47feaf4496c75799d44e","records":[{"revision":"890a1b0c032b47feaf4496c75799d44e","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-chm3-vqcf-52rx","aliases":["CVE-2026-70472"],"title":"Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store","description":"# Summary \n\nThese endpoints accept a client-controlled `credential` parameter. The server loads credentials by `id` and uses them directly, without checking whether that credential belongs to the caller’s workspace. If an attacker knows another workspace’s `credentialId`, they can use that workspace’s OpenAI key.\n\n# Details\n\nRoute permissions (`assistants:*`) only check feature access. They do not check credential ownership. The controller passes `req.query.credential` straight to the service. The service does `findOneBy({ id: credentialId })`, decrypts the credential, and calls OpenAI APIs. There is no `workspaceId` check in this flow, so this is an IDOR.\n\n# Impact \n\n\n- Cross-workspace unauthorized use of stored OpenAI keys.\n- Unauthorized read/modify/delete of victim vector stores and files.\n- Direct billing impact on victim OpenAI account.\n- Multi-tenant boundary violation with practical exploitability.\n\n# Reproduction steps  \n\n1. Set up two workspaces: A (attacker) and B (victim), each with an OpenAI credential.  \n2. Log in as a user in workspace A (with assistants-related permissions).  \n3. Call `/api/v1/openai-assistants-vector-store` and set `credential` to B’s credential ID.  \n4. Example: `GET /api/v1/openai-assistants-vector-store?credential=<B_credentialId>`.  \n5. If responses/actions are executed using B’s credential context, the issue is confirmed.","state":0,"publishedAt":"2026-08-04T17:51:48+00:00","modifiedAt":"2026-08-04T18:11:01.204832+00:00","affected":[{"ecosystem":"npm","name":"flowise","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.1.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:H/SA:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-chm3-vqcf-52rx","https://github.com/FlowiseAI/Flowise/pull/6170","https://github.com/FlowiseAI/Flowise/commit/d81483b70c997ddf981acc9c49fbd9a02fa345cd","https://github.com/FlowiseAI/Flowise","https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3"],"sourceUrl":"https://github.com/advisories/GHSA-chm3-vqcf-52rx","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-chm3-vqcf-52rx","identifiers":["GHSA-chm3-vqcf-52rx","CVE-2026-70472"]},"retained":false,"historicalAffected":[]}],"coverage":[]}