CVE-2026-30823CWE-639CWE-862

Flowise: IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration

High · published March 7, 2026

CVSS v3.0
8.8
EPSS
0%
Percentile
41.4
In the wild
Unconfirmed
What it is

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, there is an IDOR vulnerability, leading to account takeover and enterprise feature bypass via SSO configuration. This issue has been patched in version 3.0.13.

The record
Technical detail
CVSS v3.0
8.8 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00492 · 41.4th percentile
Weaknesses
CWE-639 · Authorization Bypass Through User-Controlled Key; CWE-862 · Missing Authorization
Published
2026-03-07T05:10Z
EPSS history
Timeline
  • 07 MAR 05:10Z
    Flowise: IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration
    cvelistv5