CVE-2026-73488

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3

Description An insecure direct object reference occurs in the 'GET /api/v1/organization/customer-default-source' endpoint. Authenticated attackers can access payment and profile data of other customers by manipulating the customerId parameter. By enumerating predictable customer IDs, unauthorized users can retrieve sensitive information such as email addresses, account balances, currency types, and billing configurations.

Recommendations Update to version 3.1.3 or later. Avoid using the customerId parameter in the 'GET /api/v1/organization/customer-default-source' endpoint until the update is applied.