CVE-2026-91933 Overview
CVE-2026-91933 is a workspace authorization bypass in Flowise, an open-source low-code platform for building large language model (LLM) applications. Versions prior to 3.1.4 fail to enforce workspace-level access controls in the openai-realtime endpoints. Authenticated users can supply an unscoped chatflowid and access ChatFlows belonging to other workspaces. The flaw allows attackers to enumerate tool definitions and invoke tools registered in victim workspaces through both GET and POST requests. Tool execution can trigger external side effects and expose sensitive outputs across tenant boundaries. The vulnerability is classified under CWE-639: Authorization Bypass Through User-Controlled Key.
Critical Impact
Authenticated tenants can invoke tools and read tool outputs from ChatFlows owned by other workspaces, breaking multi-tenant isolation.
Affected Products
- Flowise versions prior to 3.1.4
- FlowiseAI open-source LLM orchestration platform
- Multi-tenant Flowise deployments exposing openai-realtime routes
Discovery Timeline
- 2026-09-15 - CVE-2026-91933 published to the National Vulnerability Database
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-91933
Vulnerability Analysis
Flowise exposes openai-realtime endpoints that accept a chatflowid parameter to retrieve tool definitions and execute tools bound to a ChatFlow. In releases before 3.1.4, the handlers resolve the ChatFlow by identifier without validating that the requesting user's workspace owns the referenced flow. Any authenticated user, including a low-privileged tenant, can substitute the identifier of a ChatFlow in another workspace and receive its tool metadata or trigger tool execution.
The issue is a classic insecure direct object reference. The chatflowid acts as a user-controlled key, and the authorization layer trusts it without cross-checking workspace ownership. Because tools registered in ChatFlows can invoke external APIs, send emails, call webhooks, or query databases, unauthorized invocation produces real-world side effects beyond information disclosure.
Root Cause
The root cause is missing workspace scoping in the openai-realtime route handlers. Authentication is verified, but the authorization check that binds the session user to the workspace owning the ChatFlow is absent. This maps directly to [CWE-639], where object references are exposed without enforcing per-object access control.
Attack Vector
Exploitation requires valid credentials on the target Flowise instance. An attacker enumerates or guesses ChatFlow identifiers belonging to other workspaces and issues GET requests to the openai-realtime endpoint to retrieve tool definitions. The attacker then issues POST requests to invoke those tools with attacker-controlled arguments. Responses containing tool outputs are returned to the attacker, and any side effects, such as outbound HTTP calls or record modifications, execute under the victim workspace's context.
See the GitHub Security Advisory GHSA-gggp-6qmf-xwwc and the VulnCheck Authorization Bypass Advisory for endpoint details.
Detection Methods for CVE-2026-91933
Indicators of Compromise
- Requests to /api/v1/openai-realtime/* endpoints where the authenticated user's workspace does not match the chatflowid parameter.
- Unexpected tool execution events in ChatFlows correlated with sessions from users outside the owning workspace.
- Spikes in GET requests enumerating multiple chatflowid values from a single session or API key.
Detection Strategies
- Correlate application access logs with the workspace membership database to flag any chatflowid accessed by a user in a different workspace.
- Alert on anomalous fan-out of openai-realtime requests referencing multiple distinct ChatFlow identifiers in a short window.
- Review outbound traffic from tool executions for callbacks that do not match the requesting user's tenant.
Monitoring Recommendations
- Enable verbose audit logging on all Flowise API routes, including request path, chatflowid, workspace ID, and authenticated user.
- Forward Flowise logs to a centralized analytics platform for cross-workspace query correlation.
- Monitor for repeated 200 responses on openai-realtime endpoints following identifier enumeration patterns.
How to Mitigate CVE-2026-91933
Immediate Actions Required
- Upgrade Flowise to version 3.1.4 or later where workspace authorization is enforced on openai-realtime endpoints.
- Rotate API keys and session tokens for all Flowise users after upgrading to invalidate any exfiltrated credentials.
- Audit tool execution logs for cross-workspace invocations since deployment and revoke third-party credentials that may have been abused.
Patch Information
The fix is available in Flowise 3.1.4. The maintainers added workspace-scoped authorization checks in the openai-realtime handlers so that ChatFlow lookups validate ownership before returning tool definitions or executing tools. Refer to GHSA-gggp-6qmf-xwwc for the patch commit and release notes.
Workarounds
- Restrict network access to Flowise so only trusted operators can reach the API until the upgrade is applied.
- Disable or block openai-realtime routes at a reverse proxy if the feature is not required in your deployment.
- Isolate tenants into separate Flowise instances to remove the shared-workspace attack surface until patching is complete.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
