Truongvip1

**Name of the Vulnerable Software and Affected Versions** Flowise versions prior to 3.1.3 **Description** An insecure direct object reference occurs in the 'GET /api/v1/organization/customer-default-source' endpoint. Authenticated attackers can access payment and profile data of other customers by manipulating the `customerId` parameter. By enumerating predictable customer IDs, unauthorized users can retrieve sensitive information such as email addresses, account balances, currency types, and billing configurations. **Recommendations** Update to version 3.1.3 or later. Avoid using the `customerId` parameter in the 'GET /api/v1/organization/customer-default-source' endpoint until the update is applied.