THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-67622 (CRITICAL 9.9) — Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without

[NVD] CVE-2026-67622 (CRITICAL 9.9) — Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without

lownvdPublished 2026-08-06

CVE-2026-67622 CVSS: 9.9 CRITICAL Published: 2026-08-06T22:18:22.873

Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownership verification. Attackers can en

MITRE ATT&CK techniques

CredentialsT1589.001

Indicators of compromise

CVE-2026-67622cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-67622