GHSA-2364-jh4q-m9vm: Flowise: IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint

Flowise has an IDOR vulnerability (insecure direct object reference, where an attacker can access resources by guessing or changing object IDs) in its payment source endpoint that allows logged-in attackers to view other customers' sensitive data like email addresses and account balances by changing the customerId parameter in the URL. The flaw exists because the server checks only that a user is logged in, not whether they own the specific customer ID they're requesting.