p PatchFirst

CVE-2026-73488

CVE-2026-73488 · Flowise before 3.1.3 IDOR via customer-default-source endpoint

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that allows authenticated attackers to access other customers' payment and profile data by manipulating the customerId parameter. Attackers can enumerate predictable customer IDs to retrieve sensitive information including email addresses, account balances, currency types, and billing configurations without authorization checks.

CVSS 6.0 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • flowise

    Versions
    • ≥ 0, < 3.1.3: Affected (semver)
    • 3.1.3: Not affected (semver)

    Update to 3.1.3

  • flowise npm

    Affected ranges
    • SEMVER: < 3.1.3

    Update to 3.1.3

Original sources

Check your server →