CVE-2026-90533: Flowiseai Flowise Auth Bypass Vulnerability

CVE-2026-90533 Overview

CVE-2026-90533 is a broken access control vulnerability in Flowise versions before 3.1.4. The flaw resides in the GET /api/v1/organizationuser endpoint, which fails to enforce authorization checks on the requested user ID parameter. Any authenticated organization member can query the endpoint with an arbitrary user ID and retrieve the target user's full record, including the bcrypt password hash and temporary tokens. Attackers can extract the organization owner's credential hash, perform offline cracking, and take over the highest-privileged account in the tenant. The vulnerability is tracked under [CWE-862] Missing Authorization.

Critical Impact

Authenticated low-privilege users can retrieve the organization owner's bcrypt password hash and temporary tokens, enabling offline credential cracking and full account takeover of the tenant's highest-privileged account.

Affected Products

• FlowiseAI Flowise versions prior to 3.1.4
• Deployments exposing /api/v1/organizationuser to authenticated organization members
• Multi-tenant Flowise instances where owner accounts share the same organization as untrusted users

Discovery Timeline

• 2026-09-12 - CVE-2026-90533 published to NVD
• 2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90533

Vulnerability Analysis

The vulnerability exists in Flowise's organization user retrieval endpoint. The handler for GET /api/v1/organizationuser accepts a user identifier parameter and returns the corresponding user record without verifying that the requester is authorized to view that specific user. Authentication is required, but no additional authorization check confirms role, ownership, or same-account boundaries beyond organization membership. The returned object includes sensitive fields that should never leave the server, notably the bcrypt password hash and any active temporary tokens issued to the target account. Because Flowise organization owners hold administrative privileges over workflows, credentials, and integrations, exposing the owner record collapses the tenant's privilege model.

Root Cause

The root cause is missing object-level authorization on the organization user endpoint. The controller treats organization membership as sufficient authorization and returns full user records, including secrets, rather than filtered projections. The response schema also fails to strip credential material such as credential (bcrypt hash) and tempToken fields before serialization.

Attack Vector

An attacker first obtains any valid authenticated session inside the target organization, such as a low-privilege invited member. The attacker then issues a GET request to /api/v1/organizationuser supplying the user ID of the organization owner. The server returns the owner's full record. The attacker feeds the extracted bcrypt hash into an offline cracker such as Hashcat or John the Ripper. Once the plaintext password is recovered, the attacker authenticates as the owner and takes control of the tenant. See the VulnCheck Advisory on Flowise and the GitHub Security Advisory GHSA-fhxm-xxcx-g6x3 for additional technical details.

Detection Methods for CVE-2026-90533

Indicators of Compromise

• Requests to /api/v1/organizationuser supplying user IDs that do not belong to the requesting principal
• Repeated GET /api/v1/organizationuser calls enumerating sequential or varied user IDs from a single session
• Successful authentications as the organization owner from new IP addresses or user agents shortly after such enumeration
• Unexpected changes to owner-owned workflows, API keys, or connected credentials

Detection Strategies

• Parse Flowise application and reverse-proxy logs for GET /api/v1/organizationuser requests and correlate the caller identity with the returned user ID
• Alert on any response from /api/v1/organizationuser whose payload size or content suggests inclusion of credential or tempToken fields
• Baseline normal usage of the endpoint per role and flag deviations by non-admin accounts

Monitoring Recommendations

• Forward Flowise access logs and authentication events to a centralized log platform for correlation
• Track owner-account logins and require alerting on first-seen source IPs or clients
• Monitor for offline-cracking indicators such as sudden owner logins following an unusual API enumeration burst

How to Mitigate CVE-2026-90533

Immediate Actions Required

• Upgrade Flowise to version 3.1.4 or later on all instances
• Rotate all organization owner passwords and invalidate outstanding temporary tokens after upgrading
• Audit access logs since deployment for prior calls to /api/v1/organizationuser and investigate any cross-user access
• Restrict network exposure of the Flowise API to trusted networks or authenticated reverse proxies

Patch Information

FlowiseAI addressed the issue in Flowise 3.1.4. Refer to the GitHub Security Advisory GHSA-fhxm-xxcx-g6x3 for the fix commit and release notes. The patched handler enforces authorization on the target user ID and strips credential material from the response.

Workarounds

• Block or restrict /api/v1/organizationuser at a reverse proxy or Web Application Firewall to admin roles only until the upgrade is applied
• Remove or disable non-essential low-privilege accounts inside organizations that contain sensitive owner credentials
• Enforce strong, high-entropy passwords for owner accounts to increase offline cracking cost if hashes are exposed

# Example NGINX restriction blocking the vulnerable endpoint at the edge
location = /api/v1/organizationuser {
    deny all;
    return 403;
}