GHSA-cwc3-p92j-g7qm: Flowise has IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration
- Identifiers
- CVE-2026-30823GHSA-cwc3-p92j-g7qm
- Published
- Record updated
- Affected
- flowise <= 3.0.12
- Fixed in
- 3.0.13
- released February 3, 2026, 31 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.5%
Summary
GHSA-cwc3-p92j-g7qm describes an Insecure Direct Object Reference in the PUT /api/v1/loginmethod endpoint of the Flowise platform. The endpoint accepts an organizationId from the JSON body and updates that organization's record without checking that the authenticated user owns it or has admin rights, so any low-privileged user, including Free plan users, can overwrite another organization's SSO configuration. The source states this enables Account Takeover by replacing the victim's OAuth credentials with attacker-controlled ones, and enabling Enterprise-only SSO features without a license.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- flowisenpmLLM dependency since 2024-03-12