GHSA-hmg2-jjjx-jcp2: Flowise: missing authz on vector store CRUD endpoints

### FINDING 4: OpenAI Assistants Vector Store - No Auth on CRUD Operations **Severity**: HIGH (CVSS ~8.1) **Type**: CWE-306 (Missing Authentication for Critical Function) **File**: `packages/server/src/routes/openai-assistants-vector-store/index.ts` **Description**: ALL CRUD endpoints for OpenAI Assistants Vector Store have no authentication middleware AND the route path `/api/v1/openai-assistants-vector-store` is NOT in `WHITELIST_URLS`. However, it is also NOT protected by the main auth middleware when accessed via API key — the route requires API key auth (not whitelisted), but NO permission checks exist on any operation. The real issue is that the routes have no `checkAnyPermission()` middleware, meaning any authenticated user regardless of role can: - Create vector stores - Upload files to vector stores - Delete vector stores and files - Modify any vector store **Evidence**: ```typescript // No permission middleware on any route router.post('/', controller.createAssistantVectorStore) // No permission check router.put(['/', '/:id'], controller.updateAssistantVectorStore) // No permission check router.delete(['/', '/:id'], controller.deleteAssistantVectorStore) // No permission check router.post('/:id', getMulterStorage().array('files'), controller.uploadFilesToAssistantVectorStore) // No permission check ``` **Impact**: Any authenticated user can manipulate OpenAI vector stores, upload malicious files, delete data, or exfiltrate stored documents regardless of their assigned permissions.

An attacker with any valid Flowise account — obtained via credential stuffing against a self-hosted instance, phishing a low-privilege employee, or registering a trial account — directly calls the unprotected vector store CRUD endpoints. They first enumerate existing vector stores and retrieve all associated files, exfiltrating the organization's proprietary document collection used to ground AI agents. They then upload a crafted file containing indirect prompt injection payloads into a high-priority vector store. When legitimate users query AI agents backed by that store, the poisoned knowledge base causes the agent to return attacker-controlled responses — leaking system prompts, steering users toward malicious content, or performing unauthorized tool calls. Finally, the attacker deletes the original clean files to remove evidence and maximize disruption to agent operations.