CVE-2026-73488

Flowise versions before 3.1.3 contain an insecure direct object reference (IDOR, CWE-639) in the GET /api/v1/organization/customer-default-source endpoint. An authenticated attacker sends requests to this endpoint with an arbitrary or guessed customerId parameter, and because the endpoint performs no authorization check on that identifier, they can enumerate predictable customer IDs. Each successful request returns another customer's sensitive data, including email addresses, account balances, currency types, and billing configurations, with no way to modify data or execute code. Any Flowise deployment running a version prior to 3.1.3 that uses the organization/customer billing API with multiple customers is affected. No exploitation in the wild has been reported; the flaw is documented in a public Flowise GitHub security advisory and carries a low EPSS score of 0.3% (25th percentile).

What to do: Upgrade Flowise to version 3.1.3 or later, which resolves the missing authorization check. Until patched, restrict access to /api/v1/organization/customer-default-source to trusted authenticated users and review access logs for requests enumerating customerId values. Because exploitation requires valid credentials, prioritize patching internet-exposed instances and audit which accounts can reach the organization billing API.