What’s Vulnerable › Vulnerabilities

CVE-2026-90533: Flowise before 3.1.4 Broken Access Control via organizationuser

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-09-12 · updated 2026-09-15
• Weakness: CWE-862

Description

Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser that allows any authenticated organization member to retrieve the organization owner's full user record including bcrypt password hash and temporary tokens. Attackers can query the endpoint with any user ID to obtain the owner's credential hash for offline cracking, enabling account takeover of the highest-privileged account.

Affected products

• FlowiseAI Flowise: before 3.1.4 — fixed in 3.1.4

How to fix

Upgrade to a fixed version: FlowiseAI Flowise 3.1.4. Check the vendor advisory for mitigations.

References

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-fhxm-xxcx-g6x3
• https://www.vulncheck.com/advisories/flowise-before-3.1.4-broken-access-control-via-organizationuser
• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-fhxm-xxcx-g6x3

Get alerted when CVE-2026-90533 or the next vulnerability affects your stack