CVE-2026-91933: Flowise before 3.1.4 fails to enforce workspace-level authorization checks in openai-realtime endpoints, allowing authen

Flowise (a workflow automation tool) versions before 3.1.4 have a security flaw where it doesn't properly check if users have permission to access different workspaces (isolated project areas) in its OpenAI real-time endpoints. An authenticated user (someone with valid login credentials) can trick the system into letting them view and run tools from other users' workspaces by providing an unscoped chatflowid (a reference number without proper access restrictions), potentially exposing sensitive information and triggering unwanted actions.