CVE-2026-67622

criticalCVSS 9.9covered by 1 sourcefirst seen 2026-08-06

Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownership verification. Attackers can enumerate cross-workspace assistant metadata, retrieve file and vector store listings, and upload files into victim workspaces by exploiting the missing workspace-scoped authorization check in the credential lookup logic.

⚡ Watch CVE-2026-67622

Get an email if CVE-2026-67622 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

criticalCVE-2026-67622: Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI…nvd · 2026-08-06

External references

NVD record for CVE-2026-67622

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-67622 status](https://www.csirts.com/badge/CVE-2026-67622)](https://www.csirts.com/cve/CVE-2026-67622)