CVE-2026-73488: Flowise before 3.1.3 IDOR via customer-default-source endpoint
Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that allows authenticated attackers to access other customers' payment and profile data by manipulating the customerId parameter. Attackers can enumerate predictable customer IDs to retrieve sensitive information including email addresses, account balances, currency types, and billing configurations without authorization checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Flowiseto a version that resolves this vulnerability.Fixed in 3.1.3 - Compensating control
Until upgraded past the vulnerable release, restrict access to the GET /api/v1/organization/customer-default-source endpoint (especially customerId-based requests) so only authorized users can query their own customer data.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73488?
CVE-2026-73488 has a risk score of 65, indicating a moderate level of severity.
How do I fix CVE-2026-73488?
To mitigate CVE-2026-73488, upgrade to Flowise version 3.1.3 or higher.
What does CVE-2026-73488 exploit?
CVE-2026-73488 exploits an insecure direct object reference vulnerability in the customer-default-source endpoint.
What type of data is vulnerable in CVE-2026-73488?
CVE-2026-73488 allows attackers to access other customers' payment and profile data.
Who is affected by CVE-2026-73488?
Authenticated users of Flowise versions before 3.1.3 may be affected by CVE-2026-73488.