CVE-2026-100609: Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up credentials by ID without filtering on

Flowise (a workflow automation tool available as npm packages) versions up to 3.1.4 has a security flaw where it retrieves stored credentials (like API keys) by ID without checking if the user requesting them belongs to the correct workspace (a group or project within the system). An authenticated attacker can use this flaw to access and decrypt API keys from other workspaces by providing their credential IDs, potentially gaining unauthorized access to external services like OpenAI or ElevenLabs.