CVE-2026-30823

Published: Mar 7, 2026Modified: Mar 11, 2026

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: security-advisories@github.com (Secondary)

Description

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, there is an IDOR vulnerability, leading to account takeover and enterprise feature bypass via SSO configuration. This issue has been patched in version 3.0.13.

Affected (1)

Products: Flowiseai: Flowise

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Flowiseai Flowise	Before 3.0.13

Related CWEs

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (2)

https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.13

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-cwc3-p92j-g7qm

Source: security-advisories@github.com

ExploitVendor Advisory

Timeline

No history available yet.