Authorization Bypass Vulnerability in Flowise by FlowiseAI

CVE-2026-91933

What is CVE-2026-91933?

Flowise versions prior to 3.1.4 contain a significant vulnerability that undermines workspace-level authorization checks for the openai-realtime endpoints. This flaw permits authenticated users to maliciously access tools from ChatFlows across different workspaces by manipulating the chatflowid input. As a result, attackers can execute unauthorized GET and POST requests, gaining access to sensitive tool definitions and outputs, which can lead to external side effects and a breach of data confidentiality.

References