Broken Access Control in Flowise Affects User Data Retrieval

CVE-2026-90533

What is CVE-2026-90533?

Flowise prior to version 3.1.4 is affected by a broken access control vulnerability in the GET /api/v1/organizationuser endpoint. This flaw allows any authenticated member of an organization to access sensitive information related to the organization owner, including the bcrypt password hash and temporary tokens. Attackers can exploit this vulnerability by querying the endpoint using arbitrary user IDs, potentially leading to the offline cracking of the organization owner’s credentials, which paves the way for account takeovers of the highest-privileged accounts.

References