{"cve":"CVE-2026-73488","nvd":{"published":"2026-08-13T12:17:24.220","modified":"2026-10-24T15:10:00.190","status":"Analyzed","description":"Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that allows authenticated attackers to access other customers' payment and profile data by manipulating the customerId parameter. Attackers can enumerate predictable customer IDs to retrieve sensitive information including email addresses, account balances, currency types, and billing configurations without authorization checks.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":6.0},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5},"cwes":["CWE-639"],"references":["https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-2364-jh4q-m9vm","https://www.vulncheck.com/advisories/flowise-before-idor-via-customer-default-source-endpoint","https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-2364-jh4q-m9vm"],"products":["flowiseai:flowise"],"source":"nvd","synced_at":"2026-10-24T16:53:35.584907681+00:00"},"epss":{"cve":"CVE-2026-73488","score":0.0037,"percentile":0.30592,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-2364-jh4q-m9vm","url":"https://osv.dev/vulnerability/GHSA-2364-jh4q-m9vm","summary":"Flowise: IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint","modified":"2026-08-14T04:12:11.066302786Z","packages":[{"ecosystem":"npm","name":"flowise","purl":"pkg:npm/flowise","ranges":["<3.1.3"],"fixed":["3.1.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}