Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store

# Summary These endpoints accept a client-controlled `credential` parameter. The server loads credentials by `id` and uses them directly, without checking whether that credential belongs to the caller’s workspace. If an attacker knows another workspace’s `credentialId`, they can use that workspace’s OpenAI key. # Details Route permissions (`assistants:*`) only check feature access. They do not check credential ownership. The controller passes `req.query.credential` straight to the service. The service does `findOneBy({ id: credentialId })`, decrypts the credential, and calls OpenAI APIs. There is no `workspaceId` check in this flow, so this is an IDOR. # Impact - Cross-workspace unauthorized use of stored OpenAI keys. - Unauthorized read/modify/delete of victim vector stores and files. - Direct billing impact on victim OpenAI account. - Multi-tenant boundary violation with practical exploitability. # Reproduction steps 1. Set up two workspaces: A (attacker) and B (victim), each with an OpenAI credential. 2. Log in as a user in workspace A (with assistants-related permissions). 3. Call `/api/v1/openai-assistants-vector-store` and set `credential` to B’s credential ID. 4. Example: `GET /api/v1/openai-assistants-vector-store?credential=<B_credentialId>`. 5. If responses/actions are executed using B’s credential context, the issue is confirmed.

Source published

4 Aug 2026 17:51:48 UTC

Source modified

4 Aug 2026 18:11:01 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:H/SA:H

Publisher rating · HIGH