Description

Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint that allows unauthenticated attackers to access private files by exploiting the endpoint's inclusion in the global authentication whitelist, which bypasses all session and API key verification. Attackers can supply valid chatflowId, chatId, and fileName identifiers to retrieve files from any chatflow on the instance, including private chatflows belonging to other workspaces or organizations.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-10T19:17:31.400Z",
  "pubdate": "2026-08-10T19:17:31.400Z",
  "executiveSummary": "An unauthenticated missing authorization vulnerability exists within Flowise versions 2.2.4 through 3.1.4, specifically impacting the POST /api/v1/openai-assistants-file/download endpoint.\nThe security flaw arises due to the vulnerable endpoint's inclusion in the global authentication whitelist, which completely bypasses standard session validation and API key verification mechanisms.\nBy supplying valid identifiers such as chatflowId, chatId, and fileName, malicious actors can remotely retrieve private files originating from any chatflow hosted on the targeted Flowise instance.\nThis unauthorized data access extends across workspace and organization boundaries, allowing the retrieval of sensitive assets from private chatflows belonging to other users.\nThe risk implications are severe, as unauthenticated attackers with network visibility can exploit this flaw to exfiltrate confidential files without possessing any prior credentials or privileges.\nRemediation requires updating affected installations to secure versions or properly enforcing authentication checks on the designated file download route.",
  "technicalDetails": "The vulnerability resides in the POST /api/v1/openai-assistants-file/download endpoint of the Flowise application, affecting all versions from 2.2.4 up to and including 3.1.4.\nThe root cause of the issue is an access control misconfiguration where the specified file download handler is incorrectly mapped within the application's global authentication whitelist.\nBecause the route is whitelisted, the web application framework fails to execute session checks and API key verification routines prior to processing incoming HTTP POST requests.\nTo exploit this vulnerability, an unauthenticated attacker sends a crafted POST request to the vulnerable endpoint over the network.\nThe request payload must contain specific required parameters, specifically valid values for chatflowId, chatId, and fileName.\nUpon receiving the request, the backend handler processes the retrieval logic without validating whether the requesting entity possesses authorization or ownership over the specified chatflow or workspace.\nConsequently, the server retrieves and returns the requested file, granting unauthorized access to private assets stored across different user workspaces or multi-tenant organizational boundaries.\nThe attack requires zero privileges and no user interaction, exposing the affected Flowise instance to complete confidentiality breaches regarding stored assistant files."
}