MEDIUM

CVE-2026-90533

Flowiseai Flowise 2026-09-12 CVSS v3.1

CVSS

6.5

Description

Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser that allows any authenticated organization member to retrieve the organization owner's full user record including bcrypt password hash and temporary tokens. Attackers can query the endpoint with any user ID to obtain the owner's credential hash for offline cracking, enabling account takeover of the highest-privileged account.

Weakness (CWE)

CWE-862 Missing Authorization

EPSS Score

0.2%

Probability of exploitation in next 30 days

9.5th percentile

References

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-fhxm-xxcx-g6x3 Exploit, Vendor Advisory https://www.vulncheck.com/advisories/flowise-before-3.1.4-broken-access-control-via-organizationuser Third Party Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE