CVE-2026-73488
Received Received - Intake

Insecure Direct Object Reference in Flowise Exposes Customer Payment Data

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description
Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that allows authenticated attackers to access other customers' payment and profile data by manipulating the customerId parameter. Attackers can enumerate predictable customer IDs to retrieve sensitive information including email addresses, account balances, currency types, and billing configurations without authorization checks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-73488
EUVD
EUVD-2026-57804

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
flowise flowise to 3.1.3 (exc)
flowiseai flowise to 3.1.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in Flowise versions before 3.1.3. It exists in the GET /api/v1/organization/customer-default-source endpoint where attackers can manipulate the customerId parameter to access other customers' sensitive data without proper authorization checks.

Detection Guidance

To detect this vulnerability, monitor API logs for repeated GET requests to /api/v1/organization/customer-default-source with varying customerId parameters. Check for unauthorized access attempts or unusual data retrieval patterns from authenticated users.

Impact Analysis

Attackers can enumerate predictable customer IDs to retrieve sensitive information such as email addresses, account balances, currency types, and billing configurations. This can lead to data privacy breaches and financial information leakage for affected users.

Compliance Impact

This vulnerability poses risks of compliance violations under regulations like GDPR due to potential data privacy breaches and unauthorized access to sensitive customer information.

Mitigation Strategies

Immediately update Flowise to version 3.1.3 or later. Implement strict authorization checks to ensure users can only access their own data. Disable or restrict access to the vulnerable endpoint if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73488. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart