Description

Flowise versions before 3.1.4 contain cross-tenant authorization gaps in Enterprise endpoints that fail to verify resource ownership before operations. Attackers with Enterprise access can delete arbitrary workspaces, invite themselves into other organizations, modify cross-org roles, and abuse stored SSO secrets.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-15T16:17:43.187Z",
  "pubdate": "2026-09-15T16:17:43.187Z",
  "executiveSummary": "Flowise versions prior to 3.1.4 are susceptible to severe cross-tenant authorization vulnerabilities residing within Enterprise-specific endpoints. The security flaw stems from a failure to perform adequate ownership verification for resources during API requests. This vulnerability enables authenticated attackers who possess Enterprise-level access to bypass organizational boundaries, effectively compromising the multi-tenancy model of the application.\nThe impact is critical, as an attacker can perform unauthorized administrative actions across disparate organizations. Attacker capabilities include the deletion of arbitrary workspaces, unauthorized invitation into foreign organizations, modification of cross-organizational roles, and the exploitation of stored Single Sign-On (SSO) secrets. The vulnerability necessitates that the attacker already possesses valid Enterprise credentials; however, it does not require administrative privileges within the victim organization. Successful exploitation leads to full data exposure, unauthorized access to sensitive tenant configurations, and potential persistence mechanisms within compromised environments, posing a significant risk to the integrity and confidentiality of the Flowise deployment.",
  "technicalDetails": "The vulnerability originates from inadequate server-side authorization checks within the Flowise Enterprise API endpoints. In a multi-tenant architecture, the application is expected to enforce strict boundary checks by validating that the session token’s associated tenant identifier matches the target resource's owner identifier. In affected versions prior to 3.1.4, these verification mechanisms are absent or incorrectly implemented in critical administrative and configuration endpoints.\nThe exploitation flow relies on the attacker manipulating API requests targeting the Enterprise module. By modifying parameters—such as workspace IDs or organization tokens—within the request payload, an authenticated user can interact with objects belonging to other tenants. Because the backend fails to cross-reference the authenticated user's organization scope against the requested resource's owner, the application processes the request as a legitimate administrative operation.\nSpecific attack vectors include:\n1. Unauthorized Resource Deletion: By sending a DELETE request to workspace management endpoints with a target workspace ID outside the attacker's authorized scope, the user can effectively purge organizational data due to missing authorization middleware.\n2. Tenant Hopping via Invitation: An attacker can invoke user invitation endpoints to inject their own identifiers or malicious accounts into foreign organizations, thereby gaining a foothold in target tenants.\n3. Privilege Escalation and Role Manipulation: By targeting the endpoint responsible for role management, an attacker can elevate their own permissions within a remote organization, granting themselves administrative capabilities that are normally restricted by the tenant boundary.\n4. SSO Secret Harvesting: The vulnerability extends to endpoints that manage configuration secrets, including SSO integration tokens. By querying these endpoints without tenant isolation, attackers can retrieve sensitive credentials used for authentication integrations, potentially leading to identity provider compromise.\nThe vulnerable component is the Enterprise API controller, which fails to enforce session-to-resource ownership mapping. This issue is categorized as an Improper Authorization vulnerability. As the endpoints are accessible via standard HTTP methods (POST, PUT, DELETE), the exposure is limited to authenticated enterprise users but does not require specific elevated privileges, making it a high-risk horizontal and vertical authorization bypass."
}