{"id":"CVE-2026-70472","aliases":["GHSA-chm3-vqcf-52rx"],"url":"https://o3.security/vulnerability/CVE-2026-70472","summary":"Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store","details":"# Summary \n\nThese endpoints accept a client-controlled `credential` parameter. The server loads credentials by `id` and uses them directly, without checking whether that credential belongs to the caller’s workspace. If an attacker knows another workspace’s `credentialId`, they can use that workspace’s OpenAI key.\n\n# Details\n\nRoute permissions (`assistants:*`) only check feature access. They do not check credential ownership. The controller passes `req.query.credential` straight to the service. The service does `findOneBy({ id: credentialId })`, decrypts the credential, and calls OpenAI APIs. There is no `workspaceId` check in this flow, so this is an IDOR.\n\n# Impact \n\n\n- Cross-workspace unauthorized use of stored OpenAI keys.\n- Unauthorized read/modify/delete of victim vector stores and files.\n- Direct billing impact on victim OpenAI account.\n- Multi-tenant boundary violation with practical exploitability.\n\n# Reproduction steps  \n\n1. Set up two workspaces: A (attacker) and B (victim), each with an OpenAI credential.  \n2. Log in as a user in workspace A (with assistants-related permissions).  \n3. Call `/api/v1/openai-assistants-vector-store` and set `credential` to B’s credential ID.  \n4. Example: `GET /api/v1/openai-assistants-vector-store?credential=<B_credentialId>`.  \n5. If responses/actions are executed using B’s credential context, the issue is confirmed.","published":"2026-08-04T17:46:05.452Z","modified":"2026-10-28T02:30:41.731571470Z","cvss":null,"epss":{"score":0.00246,"percentile":0.16224,"asOf":"2026-08-22"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"flowise","fixedVersion":"3.1.3"}],"fix":{"url":"https://github.com/FlowiseAI/Flowise/commit/d81483b70c997ddf981acc9c49fbd9a02fa345cd","label":"FlowiseAI/Flowise@d81483b"},"references":[{"type":"WEB","url":"https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70472.json"},{"type":"ADVISORY","url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-chm3-vqcf-52rx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70472"},{"type":"FIX","url":"https://github.com/FlowiseAI/Flowise/commit/d81483b70c997ddf981acc9c49fbd9a02fa345cd"},{"type":"FIX","url":"https://github.com/FlowiseAI/Flowise/pull/6170"},{"type":"PACKAGE","url":"https://github.com/FlowiseAI/Flowise"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:41.731571470Z"}}