CVE-2026-90533

Think of Flowise like a shared office app for your organization. This flaw means a regular employee who is already logged in can use a special link/address to peek at the top manager’s private account details. Those details can include sensitive credential information, which could help someone break into the highest-privilege account.

This matters if you use Flowise and multiple people have accounts in the same organization (because any logged-in organization member can reach the issue). It is only a risk when the attacker already has access as a valid organization member, not for random outsiders. In other words: update if you have shared organizations where an insider account (or a compromised member account) could be present.

This is high priority because authenticated organization members can directly access the organization owner’s private account details, which can enable admin-level takeover. There’s no known public exploit code listed, but the issue is reachable by default in the affected versions and the fix is available in Flowise 3.1.4.

Confirm exposure

1. Identify your installed Flowise version.
2. Confirm whether the version is before 3.1.4.
3. Confirm your Flowise deployment uses organizations with multiple member accounts (since exploitation requires being authenticated as any valid member).

Upgrade / patch

1. Upgrade Flowise to 3.1.4 (this is the fixed version).
2. If you manage deployments via containers, orchestration, or a package registry, ensure the running service is actually on 3.1.4 after the rollout (not just rebuilt).
3. Plan for a short validation window after upgrade.

Post-upgrade verification (practical)

1. Use a regular (non-owner) organization member test account.
2. Attempt whatever “organization-user” access path your app/process uses to fetch organization owner private details.
3. Confirm the member can no longer view the owner’s private user record (especially sensitive credential material and temporary tokens).

Temporary workaround (if upgrade is delayed)

• Reduce organization member access while you wait for the upgrade: remove accounts that should not have member privileges, and ensure only trusted accounts remain.
• If you have an ability to limit which users can access organization features/endpoints, disable or restrict access to the affected organization-user functionality until you can upgrade.

What to monitor

• Monitor Flowise logs for unusual attempts to access organization owner user details or repeated calls to the organization-user endpoint from non-owner accounts.
• Review any suspicious logins or token use for organization owners around the timeframe of access.

Timing note

• No CISA KEV listing was found for this issue.

Severity is reported as medium (CVSS 6.5), with the key real-world risk being account takeover due to broken access control. The weakness is CWE-862 and the specific mechanism is Broken Access Control in GET /api/v1/organizationuser: any authenticated organization member can request another user’s record (specifically the organization owner) rather than being restricted to their own data. The findings indicate sensitive fields may be exposed (including the password hash and temporary access keys), which can enable offline cracking or misuse for takeover.

Exploitation status: no public exploit code is on record and there is no KEV entry; however, the findings state the issue is reachable in default configuration for the affected versions and preconditions are low (authenticated member). EPSS is a prediction and is not treated as proof of exploitation.