THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-90533 — Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser that allows any authenticated organization member to retrieve the organization owner's full user record including bcrypt password hash and temporary tokens. Attackers can query the

[NVD] CVE-2026-90533 — Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser that allows any authenticated organization member to retrieve the organization owner's full user record including bcrypt password hash and temporary tokens. Attackers can query the

mednvdPublished 2026-09-12

CVE-2026-90533 CVSS: None Published: 2026-09-12T13:16:51.100

Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser that allows any authenticated organization member to retrieve the organization owner's full user record including bcrypt password hash and temporary tokens. Attackers can query the endpoint with any user ID to obtain the owner's credenti

Indicators of compromise

CVE-2026-90533cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-90533