PT-2026-23789 · Flowise · Flowise

Berkdedekarginoglu · Published 2026-03-06 · Updated 2026-03-07 · CVE-2026-30823

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.0.13

Description Flowise is a drag & drop user interface to build customized large language model flows. A critical Insecure Direct Object Reference (IDOR) vulnerability, combined with a Business Logic Flaw, exists in the PUT /api/v1/loginmethod endpoint. The endpoint does not validate if the authenticated user has ownership or administrative rights over the target organizationId. This allows a low-privileged user to overwrite the SSO configuration of any organization, enable Enterprise-only features without a license, and perform Account Takeover by redirecting the authentication flow. The backend accepts the organizationId parameter from the JSON body and updates the database record without checking if request.user.organizationId equals body.organizationId. An attacker can send a crafted PUT request to the /api/v1/loginmethod endpoint, modifying the victim's Google SSO configuration by replacing legitimate OAuth credentials with malicious application credentials. This can lead to session hijacking or credential theft when victim employees attempt to log in via SSO.

Recommendations Versions prior to 3.0.13 should be updated to version 3.0.13 or later.

Exploit

Fix

IDOR

Missing Authorization

Weakness Enumeration

CWE-639

CWE-862

Related Identifiers

CVE-2026-30823

GHSA-CWC3-P92J-G7QM

Affected Products

Flowise

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30823.json · Exploit
• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-cwc3-p92j-g7qm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30823 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30823 · Security Note
• https://osv.dev/vulnerability/GHSA-cwc3-p92j-g7qm · Vendor Advisory
• https://github.com/FlowiseAI/Flowise · Note
• https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.13 · Note
• https://twitter.com/CveFindCom/status/2030171958508179538 · Twitter Post
• https://t.me/CVEtracker/46692 · Telegram Post
• https://twitter.com/TheHackerWire/status/2030193485677232300 · Twitter Post
• https://twitter.com/CVEnew/status/2030339355148222633 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2030191325362942079 · Twitter Post
• https://t.me/cveNotify/154571 · Telegram Post