---
id: CVE-2026-100609
title: >-
  Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks
  up credentials by ID without filtering on the requesting user's workspace
  (findOneBy({ id: credentialId }) with no workspaceId condition) in several
  code paths…
summary: >-
  Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks
  up credentials by ID without filtering on the requesting user's workspace
  (findOneBy({ id: credentialId }) with no workspaceId condition) in several
  code paths…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-639
vendor: FlowiseAI
product: Flowise
affected:
  - Flowise <= 3.1.4
  - Flowise <= 3.1.4
published: '2026-09-26'
updated: '2026-09-26'
sourceUpdated: '2026-09-26T14:16:41.407'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-100609'
references:
  - url: >-
      https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-27w2-26m5-x82c
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/flowise-through-3.1.4-insecure-direct-object-reference-via-credential
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-26T13:33:20.933Z'
---

## Overview

Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace (findOneBy({ id: credentialId }) with no workspaceId condition) in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant (GET /api/v1/openai-assistants and /api/v1/openai-assistants/:id), uploadFilesToAssistant (POST /api/v1/openai-assistants-file/upload/), deleteAssistant (DELETE /api/v1/assistants/:id, reachable by first importing a poisoned assistant row via POST /api/v1/export-import/import), and the shared helper used by getVoices (GET /api/v1/text-to-speech/voices). An authenticated user of one workspace can supply a credential UUID belonging to another workspace, causing the server to decrypt and use that workspace's OpenAI or ElevenLabs API key on the attacker's behalf. No patched version was available at the time of publication.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.