Authorization bypass through user-controlled key in Flowise - CVE-2026-73488
Published: July 27, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU139751
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-73488
CWE-ID: CWE-639
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in the GET /api/v1/organization/customer-default-source endpoint when handling requests with a user-controlled customerId parameter. A remote user can modify the customerId parameter in a crafted request to disclose sensitive information.
The endpoint requires a valid session or token, but it does not verify whether the requesting user is authorized to access the specified customer record. Predictable customer identifiers may enable enumeration of other customers' data.
Affected software
Flowise
How to mitigate CVE-2026-73488
Install security update from vendor's website.
Flowise - update to 3.1.3