CVE-2026-30823

8.8 highEPSS 0.4%

High (8.8) in flowiseai flowise. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in flowise 3.0.13.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, there is an IDOR vulnerability, leading to account takeover and enterprise feature bypass via SSO configuration. This issue has been patched in version 3.0.13.

Severity

CVSS 3.0

8.8 high

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-31)
CWEs: CWE-639, CWE-862
Published: 2026-03-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

flowiseai:flowise

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-cwc3-p92j-g7qm	npm	flowise	<3.0.13	3.0.13

References

https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.13
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-cwc3-p92j-g7qm

Check your stack JSON