THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-wch5-xp77-fxg4 (high) — Flowise: Cross-Workspace OAuth2 Credential Metadata Leak

[GHSA] GHSA-wch5-xp77-fxg4 (high) — Flowise: Cross-Workspace OAuth2 Credential Metadata Leak

highgithub_advisoriesPublished 2026-08-04

GHSA-wch5-xp77-fxg4 Severity: high CVE: CVE-2026-70474

Flowise: Cross-Workspace OAuth2 Credential Metadata Leak

## Summary

Three OAuth2 credential endpoints look up credentials by `id` alone with no `workspaceId` filter. Two of these endpoints (`callback`, `refresh`) are whitelisted from all authentication. This allows:

1. **Cross-workspace credential access** — Any authenticated user can init

MITRE ATT&CK techniques

CredentialsT1589.001

Indicators of compromise

CVE-2026-70474cve
https://provider.com/oauth2/authorize?client_id=LEAKED_CLIENT_ID&scope=LEAKED_SCOPE&url
https://flowise-instance/api/v1/oauth2-credential/callbackurl
https://TARGET_INSTANCEurl
https://login.microsoftonline.com/.../authorize?client_id=VICTIM_CLIENT_ID&scope=VICTIM_SCOPES&url
https://TARGET_INSTANCE/api/v1/oauth2-credential/callbackurl

Original source: https://github.com/advisories/GHSA-wch5-xp77-fxg4