CVE-2026-30823 Details
Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, there is an IDOR vulnerability, leading to account takeover and enterprise feature bypass via SSO configuration. This issue has been patched in version 3.0.13.
A critical Insecure Direct Object Reference (IDOR) vulnerability has been identified in Flowise, a platform for building customized large language model flows. This vulnerability exists in versions prior to 3.0.13 and allows low-privileged users, including those on the 'Free' plan, to manipulate the Single Sign-On (SSO) configurations of other organizations. By exploiting this flaw, an attacker can overwrite SSO settings, enable 'Enterprise-only' features without a license, and potentially take over accounts by redirecting authentication flows.
Users are advised to update to Flowise version 3.0.13 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.13 | [email protected] | ProductRelease Notes |
| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-cwc3-p92j-g7qm | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| flowiseai flowise | < 3.0.13 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 11, 2026 | Initial Analysis | [email protected] |
| Mar 7, 2026 | New CVE Received | [email protected] |