FlowiseAI Flowise up to 3.1.2 customer-default-source customerId resource injection

Summaryinfo

A vulnerability marked as problematic has been reported in FlowiseAI Flowise up to 3.1.2. Affected by this issue is some unknown functionality of the file /api/v1/organization/customer-default-source. Performing a manipulation of the argument customerId results in resource injection. This vulnerability is cataloged as CVE-2026-73488. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in FlowiseAI Flowise up to 3.1.2. This affects an unknown code of the file /api/v1/organization/customer-default-source. The manipulation of the argument customerId with an unknown input leads to a resource injection vulnerability. CWE is classifying the issue as CWE-99. The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. This is going to have an impact on confidentiality. The summary by CVE is:

Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that allows authenticated attackers to access other customers' payment and profile data by manipulating the customerId parameter. Attackers can enumerate predictable customer IDs to retrieve sensitive information including email addresses, account balances, currency types, and billing configurations without authorization checks.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-73488 since 08/12/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 3.1.3 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• FlowiseAI

Name

• Flowise

Version

• 3.1.0
• 3.1.1
• 3.1.2

Website

• Product: https://github.com/FlowiseAI/Flowise/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion