CVE-2026-73488

Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that allows authenticated attackers to access other customers' payment and profile data by manipulating the customerId parameter. Attackers can enumerate predictable customer IDs to retrieve sensitive information including email addresses, account balances, currency types, and billing configurations without authorization checks.

CVSS 4.0

6.0CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-25)

CWE

CWE-639

Published

2026-08-13

Modified

2026-10-24

Record from

the NVD, synced 2026-10-24

Affected

• flowiseai:flowise

Packages (OSV)

References

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-2364-jh4q-m9vm
• https://www.vulncheck.com/advisories/flowise-before-idor-via-customer-default-source-endpoint
• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-2364-jh4q-m9vm

Check your stackJSON