Flowise IDOR in customer-default-source endpoint

Executive brief

Flowise, an open-source tool for building LLM applications, contains a security flaw in its billing and organization management component. An attacker with a standard user account can view the private profile and payment information of other customers, including their email addresses and account balances. This could lead to the exposure of sensitive customer data and financial details across the platform.

Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in the `GET /api/v1/organization/customer-default-source` endpoint of Flowise. The application fails to perform proper object-level authorization, verifying only that a requester has a valid session but not whether they own the requested `customerId`. An authenticated attacker can manipulate the `customerId` parameter in the query string to retrieve sensitive JSON responses containing email addresses, account balances, currency types, and invoice settings. Because customer IDs follow a predictable Stripe-formatted pattern (e.g., `cus_...`), they are susceptible to enumeration. This issue is patched in version 3.1.3.

Affected products

• FlowiseAI flowise <= 3.1.2

Timeline

• 2026-07-27: disclosed
• 2026-08-04: advisory
• 2026-08-04: patched

References

• https://api.github.com/users/truongvip1
• https://github.com/truongvip1
• https://api.github.com/users/truongvip1/gists%7B/gist_id%7D
• https://api.github.com/users/truongvip1/repos
• https://avatars.githubusercontent.com/u/127960225?v=4
• https://api.github.com/users/truongvip1/events%7B/privacy%7D