{"data":{"id":"e27d7d9b-ef3b-41a1-8742-5fb1b0c1b132","title":"GHSA-wch5-xp77-fxg4: Flowise: Cross-Workspace OAuth2 Credential Metadata Leak","summary":"Three OAuth2 credential endpoints in Flowise look up credentials by `id` alone, with no `workspaceId` filter. The `callback` and `refresh` endpoints are whitelisted from all authentication, which lets authenticated users reach credentials in other workspaces and lets unauthenticated attackers inject or refresh tokens for any credential. The source's own demonstrations show leaked `client_id` and `scope` values from another workspace, forged callbacks that overwrite a victim credential's stored tokens, and unauthenticated token refreshes.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-wch5-xp77-fxg4","publishedAt":"2026-08-04T18:01:29.000Z","cveId":"CVE-2026-70474","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["flowise@<= 3.1.2 (fixed: 3.1.3)"],"affectedPackageNames":["flowise"],"affectedPackageRefs":["npm:flowise"],"affectedVendors":[],"affectedVendorsRaw":["Flowise"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00477,"epssCheckedAt":"2026-11-04T18:09:14.469Z","kevDateAdded":null,"advisoryAliases":["GHSA-wch5-xp77-fxg4"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-08-04T18:01:29.000Z","fixReleasedAt":"2026-06-25T10:41:14.612Z","daysToFix":-40,"fixCheckedAt":"2026-10-29T21:32:11.637Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"flowise","fixedVersion":"3.1.3","matchedVersion":"3.1.3","fixReleasedAt":"2026-06-25T10:41:14.612Z","daysToFix":-40,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:32:11.491Z"}]}}