CVE-2026-30823

CVE-2026-30823 · Flowise: IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, there is an IDOR vulnerability, leading to account takeover and enterprise feature bypass via SSO configuration. This issue has been patched in version 3.0.13.

CVSS 8.8 · High · EPSS 0.4% · Fix available

Published: 2026-03-07T05:10:08.035Z
Updated: 2026-03-09T20:44:24.602Z

Stack: node

Affected products and versions

flowise
Versions
- < 3.0.13: Affected
No fix published
flowise npm
Affected ranges
- SEMVER: < 3.0.13
Update to 3.0.13

Original sources

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-cwc3-p92j-g7qm
https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.13
https://nvd.nist.gov/vuln/detail/CVE-2026-30823

Check your server →

CVE-2026-30823 · Flowise: IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration

Affected products and versions

flowise

flowise npm

Original sources