CVE-2026-71962: Unauthenticated Private File Disclosure in Flowise openai-assistants-file/download
CVE-2026-71962 is a missing authorization vulnerability (CWE-862) in Flowise versions 2.2.4 through 3.1.4. The POST /api/v1/openai-assistants-file/download endpoint is globally whitelisted, bypassing both session-cookie and API-key authentication. The handler getFileFromAssistant resolves and streams files from storage using three client-supplied identifiers (chatflowId, chatId, fileName) without verifying that the target chatflow is public or that the requester belongs to the owning workspace. An unauthenticated requester who knows a valid identifier tuple can retrieve stored files from private chatflows, including across workspace and organization boundaries. The defect is distinct from previously patched path-traversal vulnerabilities on the same endpoint; those were fixed with strict path validation, but no ownership check was ever added. The researcher also demonstrated that a sibling whitelisted endpoint (GET /api/v1/feedback/:chatflowId) discloses chatId values without authentication, reducing the identifier knowledge required for exploitation. The researcher reproduced the vulnerability against the official flowise@3.1.4 release tag.
Research notes
- Root causeThe vulnerability is a missing authorization check (CWE-862): the getFileFromAssistant handler serves files from private chatflows without verifying chatflow.isPublic, req.user presence, or workspace membership, despite the codebase containing the correct three-step authorization pattern in getSinglePublicChatflow.
- Technical detailThe endpoint is globally whitelisted in WHITELIST_URLS, bypassing both session-cookie and API-key authentication. The handler resolves the owning workspace and organization from the supplied chatflowId alone and never evaluates the requester's identity.
- Technical detailThe defect is distinct from previously patched path-traversal vulnerabilities (GHSA-99pg-hqvx-r4gf, GHSA-q67q-549q-p849) on the same endpoint; strict path-traversal validation is confirmed present and effective, but no ownership check was ever added.
- PoC researchThe researcher reproduced the vulnerability against the official flowise@3.1.4 release tag, demonstrating unauthenticated retrieval of a file from a private chatflow while the same chatflow's metadata endpoint correctly returned 401 Unauthorized.