The vulnerability in Flowise versions before 3.1.3 stems from a broken object-level authorization (BOLA) pattern where the apiOverrideStatus flag — designed to control external configuration injection — was only checked during flow rendering, not during flow execution at the /prediction/:id endpoint.
When a chatflow is marked public in Flowise's visual builder, the overrideConfig object gets unconditionally spread into the flow's runtime context. This means an attacker can send arbitrary parameters to /prediction/:id that get resolved through $flow. template variables and consumed by downstream nodes. This is not simply unauthorized access to a record — it is unauthorized injection into a template variable resolution engine. Database connectors, webhook dispatchers, and LLM prompt builders all consume resolved $flow. values, meaning the blast radius extends well beyond the chatflow itself.
To verify exposure: First, identify any Flowise instances running versions before 3.1.3. Second, audit all chatflows marked as public and check whether overrideConfig contains sensitive parameters. Third, review which nodes in those flows handle database operations, external API calls, or prompt construction — these are the injection targets. Even after patching to 3.1.3, which adds the apiOverrideStatus check at execution time, the underlying design still allows authorized users to inject properties into the template resolution context. Consider whether downstream node consumption of $flow.* variables needs additional sandboxing or input validation, particularly for nodes operating with elevated privileges.
The core failure is architectural: the authorization flag existed in the persistence layer but was never propagated to the execution layer. The visual drag-and-drop abstraction made this invisible because 'public chatflow' was framed as a display state, not an execution boundary. When using low-code platforms, explicitly audit where authorization flags defined at the UI layer actually get enforced in the API layer — the abstraction gap is where these gaps emerge.