Home

Description

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, there is an IDOR vulnerability, leading to account takeover and enterprise feature bypass via SSO configuration. This issue has been patched in version 3.0.13.

PUBLISHED Reserved 2026-03-05 | Published 2026-03-07 | Updated 2026-03-07 | Assigner GitHub_M




HIGH: 8.8CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-639: Authorization Bypass Through User-Controlled Key

CWE-862: Missing Authorization

Product status

< 3.0.13
affected

References

github.com/...lowise/security/advisories/GHSA-cwc3-p92j-g7qm

github.com/FlowiseAI/Flowise/releases/tag/flowise@3.0.13

cve.org (CVE-2026-30823)

nvd.nist.gov (CVE-2026-30823)

Download JSON