Authorization bypass through user-controlled key in Flowise - #VU146549
Published: September 1, 2026
Vulnerability details
The vulnerability allows a remote user to disclose tool definitions, execute tools, and obtain tool outputs across workspace boundaries.
The vulnerability exists due to authorization bypass through a user-controlled key in the openai-realtime GET and POST endpoints when handling a supplied chatflow ID without verifying workspace ownership. A remote user can supply a victim chatflow ID to access another workspace\'s ChatFlow runtime objects and invoke associated tools to disclose tool definitions, execute tools, and obtain tool outputs across workspace boundaries.
Exploitation is limited to users or API keys within the same Flowise organization, and tool execution can trigger external side effects depending on the victim workspace configuration.