Incorrect Authorization Affecting flowise package, versions <3.1.2

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Incorrect Authorization through the getChatflowByApiKey handler in the chatflow API and the getChatflowByApiKey query in the chatflow service. An attacker can retrieve chatflows from other workspaces by supplying a valid API key and requesting chatflow data without being constrained to the key’s workspace. This exposes chatflow definitions and related metadata to unauthorized users, allowing them to read configuration and workflow details belonging to other workspaces.

Notes

• The disclosure is broader in deployments where chatflows are left unassigned to any API key: the vulnerable query includes both apikeyid IS NULL and empty-string apikeyid records, so those “public” chatflows from other workspaces are returned alongside the caller’s own.
• The returned ChatFlow entities expose more than names or IDs; the advisory’s impact is driven by fields such as flowData, chatbotConfig, apiConfig, and TTS/STT configuration being included in the response.

• GitHub Commit
• Maintainer's Advisory