CVE-2026-30823 - Vulnerability Analysis

Overview

Flowise < 3.0.13 contains an insecure direct object reference (IDOR) vulnerability caused by improper access control in SSO configuration, letting attackers take over accounts and bypass enterprise features, exploit requires user authentication.

Severity & Score

Impact

Attackers can take over user accounts and bypass enterprise feature restrictions, leading to unauthorized access and privilege escalation.

Mitigation

Update to version 3.0.13 or later.

References

• https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.13
• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-cwc3-p92j-g7qm

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 7, 2026

🟠 CVE-2026-30823 - High (8.8) Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, there is an IDOR vulnerability, leading to account takeover and enterprise feature bypass via SSO configuration. This issue has been ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30823/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner