{"data":{"id":"e27d7d9b-ef3b-41a1-8742-5fb1b0c1b132","title":"GHSA-wch5-xp77-fxg4: Flowise: Cross-Workspace OAuth2 Credential Metadata Leak","summary":"Flowise has a security vulnerability in its OAuth2 credential handling where three endpoints look up credentials by ID alone without checking which workspace the user belongs to, and two of these endpoints skip authentication entirely. This allows authenticated users to access credentials from other workspaces, and unauthenticated attackers to inject forged OAuth2 tokens or refresh tokens for any credential in the system.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-wch5-xp77-fxg4","publishedAt":"2026-08-04T18:01:29.000Z","cveId":"CVE-2026-70474","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["flowise@<= 3.1.2 (fixed: 3.1.3)"],"affectedVendors":["LangChain"],"affectedVendorsRaw":["Flowise"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0,"patchAvailable":true,"disclosureDate":"2026-08-04T18:01:29.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.92,"researchCategory":null,"atlasIds":["AML.T0010"]}}