{"id":"GHSA-chm3-vqcf-52rx","summary":"Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store","details":"# Summary \n\nThese endpoints accept a client-controlled `credential` parameter. The server loads credentials by `id` and uses them directly, without checking whether that credential belongs to the caller’s workspace. If an attacker knows another workspace’s `credentialId`, they can use that workspace’s OpenAI key.\n\n# Details\n\nRoute permissions (`assistants:*`) only check feature access. They do not check credential ownership. The controller passes `req.query.credential` straight to the service. The service does `findOneBy({ id: credentialId })`, decrypts the credential, and calls OpenAI APIs. There is no `workspaceId` check in this flow, so this is an IDOR.\n\n# Impact \n\n\n- Cross-workspace unauthorized use of stored OpenAI keys.\n- Unauthorized read/modify/delete of victim vector stores and files.\n- Direct billing impact on victim OpenAI account.\n- Multi-tenant boundary violation with practical exploitability.\n\n# Reproduction steps  \n\n1. Set up two workspaces: A (attacker) and B (victim), each with an OpenAI credential.  \n2. Log in as a user in workspace A (with assistants-related permissions).  \n3. Call `/api/v1/openai-assistants-vector-store` and set `credential` to B’s credential ID.  \n4. Example: `GET /api/v1/openai-assistants-vector-store?credential=\u003cB_credentialId\u003e`.  \n5. If responses/actions are executed using B’s credential context, the issue is confirmed.","aliases":["CVE-2026-70472"],"modified":"2026-08-04T18:11:01.204832Z","published":"2026-08-04T17:51:48Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-08-04T17:51:48Z","nvd_published_at":null,"cwe_ids":["CWE-285","CWE-863"],"severity":"HIGH"},"references":[{"type":"WEB","url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-chm3-vqcf-52rx"},{"type":"WEB","url":"https://github.com/FlowiseAI/Flowise/pull/6170"},{"type":"WEB","url":"https://github.com/FlowiseAI/Flowise/commit/d81483b70c997ddf981acc9c49fbd9a02fa345cd"},{"type":"PACKAGE","url":"https://github.com/FlowiseAI/Flowise"},{"type":"WEB","url":"https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3"}],"affected":[{"package":{"name":"flowise","ecosystem":"npm","purl":"pkg:npm/flowise"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.1.3"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 3.1.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-chm3-vqcf-52rx/GHSA-chm3-vqcf-52rx.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:H/SA:H"}]}