AI Threat AlertCVE-2026-73488: Flowise: IDOR exposes cross-tenant billing/PII data
UNKNOWNCISA: TRACK*Flowise before 3.1.3 ships an insecure direct object reference in its GET /api/v1/organization/customer-default-source endpoint: any authenticated user can swap the customerId parameter and pull other customers' email addresses, account balances, currency, and billing configuration with no authorization check. This isn't a model-level exploit — it's a classic broken access control bug in the multi-tenant management layer that sits alongside Flowise's agent-building platform, so exposure is limited to organizations running Flowise Cloud or a self-hosted multi-tenant deployment rather than single-tenant installs. EPSS sits at a low absolute 0.00265 (though top 81st percentile relative to all scored CVEs), it's not in CISA KEV, there's no public PoC or Nuclei template, and CISA's SSVC decision is TRACK_STAR — none of which signals active or imminent exploitation, but the attack itself requires no special skill, just a valid account and a parameter change. Upgrade to Flowise 3.1.3 or later immediately if you run any multi-tenant Flowise deployment; in the interim, audit access logs for sequential or out-of-range customerId values hitting that endpoint and treat any hits as a probable breach of customer PII and billing data.
What is the risk?
Low-to-moderate practical risk today (no KEV listing, no public exploit code, low absolute EPSS, SSVC TRACK_STAR), but the exploit itself is trivial — no authentication bypass required, only a manipulated ID on an endpoint the attacker already has legitimate access to. The real driver of severity is impact, not exploitability: a successful attacker gets confidentiality loss of payment and account data across the entire customer base of a multi-tenant Flowise deployment, which is a material privacy and regulatory exposure even though the CVE itself carries no CVSS score. 156 other CVEs recorded against the Flowise package and a 0/100 package risk score suggest a platform with a broader pattern of security debt worth factoring into vendor risk decisions.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Flowise | npm | — | No patch |
Do you use Flowise? You're affected.
How severe is it?
What should I do?
1 stepPatch: upgrade Flowise to version 3.1.3 or later immediately on any multi-tenant/Cloud deployment. Detect: review access logs for GET /api/v1/organization/customer-default-source requests where the customerId does not match the requesting session's own organization, and look for sequential/enumerated ID patterns indicative of scraping. Workaround if patching is delayed: place an authorization proxy or WAF rule in front of the endpoint that validates customerId ownership against the authenticated session before allowing the request through. Respond: if enumeration is found in logs, treat it as a confirmed billing/PII data breach and notify affected customers per applicable data protection obligations.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-73488?
Flowise before 3.1.3 ships an insecure direct object reference in its GET /api/v1/organization/customer-default-source endpoint: any authenticated user can swap the customerId parameter and pull other customers' email addresses, account balances, currency, and billing configuration with no authorization check. This isn't a model-level exploit — it's a classic broken access control bug in the multi-tenant management layer that sits alongside Flowise's agent-building platform, so exposure is limited to organizations running Flowise Cloud or a self-hosted multi-tenant deployment rather than single-tenant installs. EPSS sits at a low absolute 0.00265 (though top 81st percentile relative to all scored CVEs), it's not in CISA KEV, there's no public PoC or Nuclei template, and CISA's SSVC decision is TRACK_STAR — none of which signals active or imminent exploitation, but the attack itself requires no special skill, just a valid account and a parameter change. Upgrade to Flowise 3.1.3 or later immediately if you run any multi-tenant Flowise deployment; in the interim, audit access logs for sequential or out-of-range customerId values hitting that endpoint and treat any hits as a probable breach of customer PII and billing data.
Is CVE-2026-73488 actively exploited?
No confirmed active exploitation of CVE-2026-73488 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-73488?
Patch: upgrade Flowise to version 3.1.3 or later immediately on any multi-tenant/Cloud deployment. Detect: review access logs for GET /api/v1/organization/customer-default-source requests where the customerId does not match the requesting session's own organization, and look for sequential/enumerated ID patterns indicative of scraping. Workaround if patching is delayed: place an authorization proxy or WAF rule in front of the endpoint that validates customerId ownership against the authenticated session before allowing the request through. Respond: if enumeration is found in logs, treat it as a confirmed billing/PII data breach and notify affected customers per applicable data protection obligations.
What systems are affected by CVE-2026-73488?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks.
What is the CVSS score for CVE-2026-73488?
No CVSS score has been assigned yet.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0025Exfiltration via Cyber MeansAML.T0049Exploit Public-Facing ApplicationCompliance Controls Affected
What are the technical details?
Original Advisory
Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that allows authenticated attackers to access other customers' payment and profile data by manipulating the customerId parameter. Attackers can enumerate predictable customer IDs to retrieve sensitive information including email addresses, account balances, currency types, and billing configurations without authorization checks.
Exploitation Scenario
An attacker signs up for a legitimate, low-privilege account on a Flowise Cloud or self-hosted multi-tenant instance — no special access or social engineering needed. They call GET /api/v1/organization/customer-default-source with their own customerId to observe the expected response shape, then simply increment or guess adjacent customerId values and replay the request. Because the endpoint never checks that the requested customerId belongs to the caller's organization, each successful call returns another tenant's email address, account balance, currency, and billing configuration. The attacker automates this enumeration to harvest a large batch of customer records, which can then be sold, used for targeted phishing against the platform's paying customers, or leveraged for competitive intelligence on adoption/spend.
Weaknesses (CWE)
CWE-639Authorization Bypass Through User-Controlled KeyPrimaryCWE-639Authorization Bypass Through User-Controlled KeyCWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
- [Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
- [Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Source: MITRE CWE corpus.
References
Timeline
Related Vulnerabilities
CVE-2025-7133810.0Flowise: unauthenticated file write enables RCE
Same package: flowiseCVE-2025-5952810.0Flowise: Unauthenticated RCE via MCP config injection
Same package: flowiseCVE-2025-619139.9Flowise: path traversal in file tools leads to RCE
Same package: flowiseCVE-2026-409339.9Flowise: RCE via MCP stdio command injection
Same package: flowiseCVE-2026-464429.9Flowise: sandbox escape enables authenticated RCE
Same package: flowise