CVE-2026-67622: Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration th

Flowise versions up to 3.1.4 have a vulnerability where authenticated attackers can access credentials and data from other workspaces because the system doesn't verify workspace ownership (insecure direct object reference, a flaw where users can access resources by guessing or knowing their identifiers). Attackers can exploit this to view assistant information, access files, and upload malicious files into other users' workspaces.