Skip to content
Heist/ feed
Back to feed
Medium

Flowise before 3.1.3 IDOR via customer-default-source endpoint

Type: advisorySources: OSV

Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that allows authenticated attackers to access other customers' payment and profile data by manipulating the customerId parameter. Attackers can enumerate predictable customer IDs to retrieve sensitive information including email addresses, account balances, currency types, and billing configurations without authorization checks.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-73488
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 19:20 UTC · Revision 1

Source evidence

Flowise before 3.1.3 IDOR via customer-default-source endpoint

core-osv · Original source

Published 13 Aug 2026, 11:28 UTC

Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that allows authenticated attackers to access other customers' payment and profile data by manipulating the customerId parameter. Attackers can enumerate predictable customer IDs to retrieve sensitive information including email addresses, account balances, currency types, and billing configurations without authorization checks.

osv:CVE-2026-73488
Complete source record
{
  "id": "fb8dbdcda391123ca18123ec19eba8ab986580fd5abb02dfaee25183926af65c",
  "url": "https://osv.dev/vulnerability/CVE-2026-73488",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Flowise before 3.1.3 IDOR via customer-default-source endpoint",
    "summary": "Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that allows authenticated attackers to access other customers' payment and profile data by manipulating the customerId parameter. Attackers can enumerate predictable customer IDs to retrieve sensitive information including email addresses, account balances, currency types, and billing configurations without authorization checks.",
    "evidence": "osv:CVE-2026-73488",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-73488",
      "aliases": [
        "CVE-2026-73488",
        "GHSA-2364-jh4q-m9vm"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/flowiseai/flowise",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "09f099dbfda179e439ec677d06ad737375899eef"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "3.1.3"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "cpe": "cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "3.1.3"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "flowise@3.1.2",
            "flowise-ui@3.1.2",
            "flowise-components@3.1.2",
            "flowise@3.1.1",
            "flowise-ui@3.1.1",
            "flowise-components@3.1.1",
            "flowise@3.1.0",
            "flowise-ui@3.1.0",
            "flowise-components@3.1.0",
            "pre-langchain-v1",
            "flowise@3.0.13",
            "flowise-ui@3.0.13",
            "flowise-components@3.0.13",
            "flowise@3.0.12",
            "flowise-ui@3.0.12",
            "flowise-components@3.0.12",
            "flowise@3.0.11",
            "flowise-ui@3.0.11",
            "flowise-components@3.0.11",
            "flowise@3.0.10",
            "flowise-ui@3.0.10",
            "flowise-components@3.0.10",
            "flowise@3.0.9",
            "flowise-ui@3.0.9",
            "flowise-components@3.0.9",
            "flowise@3.0.8",
            "flowise-ui@3.0.8",
            "flowise-components@3.0.8",
            "flowise@3.0.7",
            "flowise-ui@3.0.7",
            "flowise-components@3.0.7",
            "flowise@3.0.6",
            "flowise-ui@3.0.6",
            "flowise-components@3.0.6",
            "flowise@3.0.5",
            "flowise-ui@3.0.5",
            "flowise-components@3.0.5",
            "flowise@3.0.4",
            "flowise-ui@3.0.4",
            "flowise-components@3.0.4",
            "flowise@3.0.3",
            "flowise-ui@3.0.3",
            "flowise-components@3.0.3",
            "flowise@3.0.2",
            "flowise-ui@3.0.2",
            "flowise-components@3.0.2",
            "flowise@3.0.1",
            "flowise-ui@3.0.1",
            "flowise-components@3.0.1",
            "flowise@3.0.0",
            "flowise-ui@3.0.0",
            "flowise-components@3.0.0",
            "flowise@2.2.8",
            "flowise-ui@2.2.8",
            "flowise-components@2.2.8",
            "flowise@2.2.7-patch.1",
            "flowise-ui@2.2.7-patch.1",
            "flowise-components@2.2.7-patch.1",
            "flowise@2.2.7",
            "flowise-ui@2.2.7",
            "flowise-components@2.2.7",
            "flowise@2.2.6-hotfix.1",
            "flowise@2.2.6",
            "flowise-ui@2.2.6",
            "flowise-components@2.2.6",
            "flowise@2.2.5",
            "flowise-ui@2.2.5",
            "flowise-components@2.2.5",
            "flowise@2.2.4",
            "flowise-ui@2.2.4",
            "flowise-components@2.2.4",
            "flowise@2.2.3",
            "flowise-ui@2.2.3",
            "flowise-components@2.2.3",
            "flowise@2.2.2",
            "flowise-ui@2.2.2",
            "flowise-components@2.2.2",
            "flowise@2.2.1",
            "flowise-ui@2.2.1",
            "flowise-components@2.2.1",
            "flowise@2.2.0",
            "flowise-ui@2.2.0",
            "flowise-components@2.2.0",
            "flowise@2.1.5",
            "flowise-ui@2.1.5",
            "flowise-components@2.1.5",
            "flowise@2.1.4",
            "flowise-ui@2.1.4",
            "flowise-components@2.1.4",
            "flowise@2.1.3",
            "flowise-ui@2.1.3",
            "flowise-components@2.1.3",
            "flowise@2.1.2",
            "flowise-ui@2.1.2",
            "flowise-components@2.1.2",
            "flowise@2.1.1",
            "flowise-ui@2.1.1",
            "flowise-components@2.1.1",
            "flowise@2.1.0",
            "flowise-ui@2.1.0",
            "flowise-components@2.1.0",
            "flowise@2.0.7",
            "flowise-ui@2.0.7",
            "flowise-components@2.0.7",
            "flowise@2.0.6",
            "flowise-ui@2.0.6",
            "flowise-components@2.0.6",
            "flowise@2.0.5",
            "flowise-ui@2.0.5",
            "flowise-components@2.0.5",
            "flowise@2.0.4",
            "flowise-ui@2.0.4",
            "flowise-components@2.0.4",
            "flowise@2.0.3",
            "flowise-ui@2.0.3",
            "flowise-components@2.0.3",
            "flowise@2.0.2",
            "flowise-ui@2.0.2",
            "flowise-components@2.0.2",
            "flowise@1.8.4",
            "flowise-ui@1.8.4",
            "flowise-components@1.8.6",
            "flowise@1.8.3",
            "flowise-ui@1.8.3",
            "flowise-components@1.8.4",
            "flowise@1.8.2",
            "flowise-ui@1.8.2",
            "flowise-components@1.8.3",
            "flowise@1.8.1",
            "flowise-ui@1.8.1",
            "flowise-components@1.8.1",
            "flowise@1.8.0",
            "flowise-ui@1.8.0",
            "flowise-components@1.8.0",
            "flowise@1.7.2",
            "flowise-ui@1.7.2",
            "flowise-components@1.7.2",
            "flowise@1.7.1",
            "flowise-ui@1.7.1",
            "flowise-components@1.7.1",
            "flowise@1.7.0",
            "flowise-ui@1.7.0",
            "flowise-components@1.7.0",
            "flowise@1.6.6",
            "flowise-ui@1.6.6",
            "flowise-components@1.6.8",
            "flowise@1.6.5",
            "flowise-ui@1.6.5",
            "flowise-components@1.6.7",
            "flowise@1.6.4",
            "flowise-ui@1.6.4",
            "flowise-components@1.6.6",
            "flowise@1.6.3",
            "flowise-ui@1.6.3",
            "flowise-components@1.6.5",
            "flowise@1.6.2",
            "flowise-ui@1.6.2",
            "flowise-components@1.6.4",
            "flowise@1.6.1",
            "flowise-ui@1.6.1",
            "flowise-components@1.6.3",
            "flowise@1.6.0",
            "flowise-ui@1.6.0",
            "flowise-components@1.6.2",
            "flowise@1.5.1",
            "flowise-ui@1.5.1",
            "flowise-components@1.6.1",
            "flowise@1.5.0",
            "flowise-ui@1.5.0",
            "flowise-components@1.6.0",
            "flowise@1.4.12",
            "flowise-ui@1.4.9",
            "flowise-components@1.5.3",
            "flowise@1.4.11",
            "flowise-ui@1.4.8",
            "flowise-components@1.5.2",
            "flowise@1.4.10",
            "flowise-ui@1.4.7",
            "flowise-components@1.5.1",
            "flowise@1.4.9",
            "flowise@1.4.8",
            "flowise-ui@1.4.6",
            "flowise-components@1.5.0",
            "flowise@1.4.7",
            "flowise-ui@1.4.5",
            "flowise-components@1.4.9",
            "flowise-components@1.4.8",
            "flowise@1.4.6",
            "flowise-ui@1.4.4",
            "flowise-components@1.4.7",
            "flowise@1.4.5",
            "flowise-ui@1.4.3",
            "flowise@1.4.4",
            "flowise-ui@1.4.2",
            "flowise-components@1.4.6",
            "flowise@1.4.2",
            "flowise-components@1.4.2",
            "flowise@1.4.1",
            "flowise-components@1.4.1",
            "flowise@1.4.0",
            "flowise-ui@1.4.0",
            "flowise-components@1.4.0",
            "flowise@1.3.9",
            "flowise-ui@1.3.7",
            "flowise-components@1.3.11",
            "flowise-components@1.3.10",
            "flowise@1.3.8",
            "flowise-ui@1.3.6",
            "flowise-components@1.3.9",
            "flowise@1.3.7",
            "flowise-ui@1.3.5",
            "flowise-components@1.3.8",
            "flowise@1.3.6",
            "flowise-ui@1.3.4",
            "flowise-components@1.3.7",
            "flowise@1.3.5",
            "flowise-ui@1.3.3",
            "flowise-components@1.3.5",
            "flowise@1.3.4",
            "flowise-ui@1.3.2",
            "flowise-components@1.3.4",
            "flowise@1.3.3",
            "flowise-ui@1.3.1",
            "flowise-components@1.3.3",
            "flowise@1.3.2",
            "flowise-components@1.3.2",
            "flowise@1.3.1",
            "flowise-components@1.3.1",
            "flowise@1.3.0",
            "flowise-ui@1.3.0",
            "flowise-components@1.3.0",
            "flowise@1.2.16",
            "flowise-ui@1.2.15",
            "flowise-components@1.2.17",
            "flowise@1.2.15",
            "flowise-ui@1.2.14",
            "flowise-components@1.2.16",
            "flowise@1.2.14",
            "flowise-ui@1.2.13",
            "flowise-components@1.2.15",
            "flowise@1.2.13",
            "flowise-ui@1.2.12",
            "flowise-components@1.2.14",
            "flowise@1.2.11",
            "flowise-ui@1.2.10",
            "flowise-components@1.2.12",
            "flowise@1.2.9",
            "flowise-components@1.2.10",
            "flowise@1.2.8",
            "flowise-ui@1.2.7",
            "flowise-components@1.2.9",
            "flowise@1.2.7",
            "flowise-ui@1.2.6",
            "flowise-components@1.2.8",
            "flowise@1.2.6",
            "flowise-ui@1.2.5",
            "flowise-components@1.2.7",
            "flowise@1.2.5",
            "flowise-ui@1.2.4",
            "flowise-components@1.2.6",
            "flowise@1.2.4",
            "flowise-ui@1.2.3",
            "flowise-components@1.2.5",
            "flowise@1.2.3",
            "flowise-ui@1.2.2",
            "flowise-components@1.2.4",
            "flowise-components@1.2.3",
            "flowise@1.2.2",
            "flowise-ui@1.2.1",
            "flowise-components@1.2.2",
            "flowise@1.2.1",
            "flowise-ui@1.2.0",
            "flowise-components@1.2.1",
            "flowise@1.1.1",
            "flowise-components@1.1.1",
            "flowise@1.1.0",
            "flowise-ui@1.1.0",
            "flowise-components@1.1.0",
            "flowise@1.0.1",
            "flowise@1.0.0",
            "flowise-ui@1.0.0",
            "flowise-components@1.0.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73488.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:31.497098407Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73488.json",
        "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-2364-jh4q-m9vm",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-73488",
        "https://www.vulncheck.com/advisories/flowise-before-idor-via-customer-default-source-endpoint"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-639"
        ],
        "cna_assigner": "VulnCheck",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73488.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-73488",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 498663,
  "published_at": "2026-08-13T11:28:07.407+00:00"
}