CVE-2026-73488 in Flowise
Summary
by MITRE • 08/13/2026
Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that allows authenticated attackers to access other customers' payment and profile data by manipulating the customerId parameter. Attackers can enumerate predictable customer IDs to retrieve sensitive information including email addresses, account balances, currency types, and billing configurations without authorization checks.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability represents a critical insecure direct object reference flaw that undermines the authentication and authorization mechanisms within Flowise's customer management system. The weakness exists in the GET /api/v1/organization/customer-default-source endpoint where the application fails to validate whether the authenticated user has legitimate access rights to the requested customer data. The vulnerability stems from the application's reliance on the customerId parameter directly without performing proper access control checks, allowing malicious actors to manipulate this parameter and gain unauthorized access to sensitive customer information.
The technical implementation of this flaw demonstrates a clear breakdown in the principle of least privilege enforcement. When an authenticated user makes a request to the endpoint, the system accepts the customerId parameter as provided by the client without verifying that the requesting user owns or has authorization to access that specific customer record. This design flaw enables attackers to perform enumeration attacks against predictable customer ID patterns, systematically accessing data belonging to other customers within the same organization. The vulnerability specifically affects the customer default source endpoint which typically handles payment information and profile configurations.
The operational impact of this vulnerability extends beyond simple data exposure to encompass significant financial and privacy risks for affected organizations. Attackers can extract comprehensive customer profiles including email addresses for potential phishing campaigns, account balance details that may facilitate financial fraud, currency type information that could aid in transaction manipulation, and billing configuration data that provides insight into payment processing systems. This unauthorized access capability directly violates the confidentiality requirements outlined in security frameworks such as iso 27001 and nist cybersecurity framework.
The vulnerability aligns with CWE-639 which specifically addresses insecure direct object references and represents a common pattern in web applications where improper access control validation leads to data exposure. From an attack perspective, this flaw maps directly to the privilege escalation and information disclosure techniques described in the mitre att&ck framework under tactic TA0006 (credential access) and technique T1213 (data from information repositories). The predictable nature of customer ID enumeration makes this vulnerability particularly dangerous as it requires minimal skill level for exploitation while providing substantial data access privileges.
Organizations should implement immediate mitigations including robust input validation that verifies user ownership of requested resources, implementation of proper access control checks before processing any customer data requests, and deployment of automated monitoring systems to detect unusual parameter manipulation patterns. The fix requires modifying the endpoint logic to perform authorization checks against the authenticated user's permissions before retrieving any customer information, ensuring that each request validates not only the existence of the requested resource but also the appropriateness of access based on user role and ownership relationships. Additionally, implementing rate limiting and audit logging for sensitive endpoints will help detect and prevent systematic enumeration attacks while maintaining compliance with industry standards such as pci dss requirements for protecting cardholder data.