CVE-2026-30823: Flowise IDOR Vulnerability Leading to Account Takeover and Feature Bypass
Summary
CVE-2026-30823: Flowise has IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration. Affects flowise versions < 3.0.13. Fixed in 3.0.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Flowise is an open-source platform designed for workflow automation and integration, enabling users to connect various applications and services seamlessly. It offers features such as Single Sign-On (SSO) and various authentication methods to enhance user experience and security. However, a critical vulnerability has been identified that allows unauthorized users to manipulate SSO configurations and access enterprise features without proper licensing.
Vulnerability Detail
The Flowise platform suffers from an Insecure Direct Object Reference (IDOR) vulnerability in the PUT /api/v1/loginmethod endpoint. This vulnerability arises because the endpoint does not validate whether the authenticated user has administrative rights over the specified organizationId. As a result, low-privileged users can overwrite SSO configurations of other organizations, enabling account takeover and unauthorized access to enterprise features. Attackers can exploit this flaw by sending a crafted request to modify SSO settings, potentially hijacking user sessions and stealing credentials.
How To Fix
Latest published version: 3.1.4 as of 22 Oct 2026
npm install flowise@3.1.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.0.13
This is the first release that contains the fix.
npm install flowise@3.0.13Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, organizations can implement additional access controls on their API endpoints to ensure that only authorized users can modify SSO configurations. This can be achieved by adding middleware that checks if request.user.organizationId matches the organizationId in the request body before processing the request.
Conclusion
The Flowise platform has a critical vulnerability that allows unauthorized users to modify SSO configurations, leading to potential account takeovers and unauthorized access to enterprise features. It is crucial for users to update to the patched version 3.0.13 to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for flowise →
FAQ
CVE-2026-30823 is a vulnerability in the Flowise platform that allows unauthorized users to modify SSO configurations and potentially take over accounts.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your package-lock.json.
The vulnerability can lead to account takeover, unauthorized access to sensitive data, and the ability to enable enterprise features without proper licensing.
Yes, a patch is available in version 3.0.13 of the Flowise package. Users should update to this version to mitigate the vulnerability.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for flowise.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
