Flowise Broken Access Control: Org Owner Credential Hash Leak via /api/v1/organization/user

Summary of Key Vulnerability Information Vulnerability Overview Vulnerability Name: Broken Access Control in the endpoint, leading to the leakage of the organization owner's password hash to any authenticated member. Vulnerability Type: Broken Access Control Impact: Any authenticated organization member (including those with the lowest-privilege role) can read the complete user record of the organization owner via this endpoint, which includes sensitive fields such as (password hash) and . This may lead to account takeover of the highest-privilege account. CVSS Score: 6.0 / 10 (Medium) CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N Scope of Impact Affected Versions: Fixed Version: Confirmed Presence: Present in and the current branch. Root Cause (Two Issues) 1. No Permission Check on Read Path: The handler for (line 9 in ) is registered with and , while the handlers (lines 11-13) all require . Any authenticated session can reach this GET endpoint. 2. User Scope Not Restricted: passes the parameter (lines 48-69 in ) directly into without restricting it to the requester's organization. This service method ( ) reads the organization owner's complete user record and explicitly removes the and fields (lines 148-158) before returning the response. Since the owner's log entry is written before the fields are stripped, these fields are still leaked even when a member queries the organization owner. Solution Upgrade to version 3.1.4. Core fix: Add a permission check (e.g., to the route, or restrict the query scope to the requester's organization, ensuring that sensitive fields ( , ) are properly stripped before serialization. POC (Reproduction Steps) Reproduce on a locally self-hosted Enterprise edition instance (multi-member organization, Enterprise/Cloud test enabled). Include the header in the request. Step 1: Create an organization ( ) and create an owner account named with email . Step 2: Create an organization member with the role (containing only and permissions). Step 3: Onboard the member by signing in as through User Management > User Workspace > Default Workspace > Role ( ). Step 4: Member B completes onboarding via the real link ( ). The system sends the link via email. B sets a password and logs in; the session displays , with the role set to . Step 5: Send the request as Member B: The HTTP 200 response contains the owner's User object: ```json [ { "isOrgAdmin": false, "userType": "org_lo", "user": { "email": "owner@example.com", "credential": "$2b$10$08qT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT8nqT

Goal Reached Thanks to every supporter — we hit 100%!

Flowise Broken Access Control: Org Owner Credential Hash Leak via /api/v1/organization/user

More from this source