What is GHSA-p4mj-q6c6-6f68?

GHSA-p4mj-q6c6-6f68 is a security advisory published by GitHub Security Advisories with Medium severity. Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the...

Which CVE IDs does GHSA-p4mj-q6c6-6f68 cover?

GHSA-p4mj-q6c6-6f68 covers the following CVE IDs: CVE-2026-73488. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-p4mj-q6c6-6f68Medium

Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the...

Vendor

GitHub Security Advisories

Published

August 13, 2026

Last Modified

August 13, 2026

🔗 CVE IDs covered (1)

CVE-2026-73488 →

📋 Description

Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that allows authenticated attackers to access other customers' payment and profile data by manipulating the customerId parameter. Attackers can enumerate predictable customer IDs to retrieve sensitive information including email addresses, account balances, currency types, and billing configurations without authorization checks.

🔗 References (4)

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-2364-jh4q-m9vm
https://nvd.nist.gov/vuln/detail/CVE-2026-73488
https://www.vulncheck.com/advisories/flowise-before-idor-via-customer-default-source-endpoint
https://github.com/advisories/GHSA-p4mj-q6c6-6f68