Authorization bypass through user-controlled key in Flowise - #VU139751
Published: July 27, 2026
Vulnerability identifier: #VU139751
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-639
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in the GET /api/v1/organization/customer-default-source endpoint when handling requests with a user-controlled customerId parameter. A remote user can modify the customerId parameter in a crafted request to disclose sensitive information.
The endpoint requires a valid session or token, but it does not verify whether the requesting user is authorized to access the specified customer record. Predictable customer identifiers may enable enumeration of other customers' data.
Affected software
Flowise
Remediation
Install security update from vendor's website.
Flowise - update to 3.1.3