GHSA-c2c9-mfw7-p8hw: Flowise: Cross-Workspace Chatflow Disclosure via chatflows/apikey Endpoint Returns All Unprotected Chatflows

Summary

Flowise's `/api/v1/chatflows/apikey/:apikey` endpoint returns not only the chatflows bound to the supplied API key but also every chatflow with no API key assigned, across all workspaces, because the query in `packages/server/src/services/chatflows/index.ts` has no `workspaceId` filter when `keyonly` is omitted. Any user holding a valid API key in one workspace can read the full ChatFlow entities of other workspaces, including `flowData`, `chatbotConfig`, and `textToSpeech`/`speechToText` credential IDs. The source notes that most chatflows lack an API key, so the exposure is broad by default.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• flowisenpmLLM dependency since 2024-03-12

Related items

• MediumAI coding agents expose developer screenshots on GitHub reposSimilar attack · ReversingLabs Blog
• InfoHow to Secure AI Models in Production Environments | Endor LabsSimilar attack · Endor Labs Blog
• InfoLLM Development Risks: Security Threats and Mitigation Strategies | Endor LabsSimilar attack · Endor Labs Blog
• InfoStrengthening our defenses against distillation attacksSimilar attack · Anthropic Research Blog
• LowCVE-2026-108754: GPT-Load cleartext logging exposes client proxy keys in query stringsSimilar attack · NVD/CVE Database