HighVulnerabilityLLM-specific
GHSA-chm3-vqcf-52rx: Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store
- Identifiers
- CVE-2026-70472GHSA-chm3-vqcf-52rx
- Published
- Record updated
- Affected
- flowise <= 3.1.2
- Fixed in
- 3.1.3
- released June 25, 2026, 40 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.5%
Summary
The openai-assistants-vector-store endpoints in Flowise accept a client-controlled credential parameter and load that credential by id without checking workspace ownership. An authenticated user in one workspace who knows another workspace's credentialId can use that workspace's stored OpenAI key, enabling unauthorized access to victim vector stores and files and billing against the victim's OpenAI account. The precondition is knowledge of the victim credentialId and a user holding assistants permissions.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- flowisenpmLLM dependency since 2024-03-12
Related items
- MediumCVE-2026-111372: AI ChatBot for WooCommerce WoowBot plugin authorization bypass in RAG syncSame vendor · NVD/CVE Database
- HighCVE-2026-107685: req_llm WebSocket streaming client accepts untrusted TLS certificatesSame vendor · NVD/CVE Database
- MediumCVE-2026-113459: TYPO3 OpenAI API key exposed to backend users in page sourceSame vendor · NVD/CVE Database
- MediumCVE-2026-109296: Open WebUI missing authorization lets users reach disabled model backendsSame vendor · NVD/CVE Database
- MediumCVE-2026-107430: VideoWhisper Site Manager for ChatGPT, Claude, Codex missing authorization checkSame vendor · NVD/CVE Database