CVE-2026-73488 describes an authorization bypass vulnerability in Flowise prior to version 3.1.3. The flaw exists in the GET /api/v1/organization/customer-default-source endpoint, where the customerId parameter is user-controlled and lacks proper authorization checks. Authenticated attackers can exploit this to enumerate customer IDs and access sensitive payment and profile data of other customers.

The vulnerability enables authenticated attackers to access sensitive customer data including email addresses, account balances, currency types, and billing configurations without authorization. This can lead to privacy violations and potential misuse of financial information. There is no indication of remote code execution or system compromise beyond data exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict access to the affected endpoint to trusted users and consider additional access controls or monitoring to detect misuse of the customerId parameter.