Flowise EUVD-2026-57804

Exploitation requires possession of a valid authenticated session token on the target Flowise platform instance - unauthenticated access to this endpoint is not possible based on the CVSS PR:L vector. The attacker must also supply a valid Stripe-formatted customerId (cus_XXXX) for a target account; however, Stripe customer IDs follow a consistent, enumerable alphanumeric pattern, substantially reducing this prerequisite in practice. The flaw is specific to the GET /api/v1/organization/customer-default-source endpoint and only applies to Flowise deployments with active Stripe billing integration. Limiting factors: the attacker must hold a legitimate account on the same Flowise instance, exploitation yields read-only confidentiality impact with no ability to modify data or take over accounts, and self-hosted instances without Stripe billing configured may not expose the vulnerable endpoint at all.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N) reflects a network-exploitable, low-privilege flaw with high confidentiality impact on the vulnerable system and no integrity or availability effect. The AT:P (Attack Target: Present) condition acknowledges that exploitation requires identifying a valid target customerId; however, because Stripe IDs follow a predictable pattern, this condition provides minimal practical protection. No EPSS score was provided in the intelligence data, and the vulnerability is not currently listed in the CISA KEV catalog, so confirmed widespread exploitation cannot be asserted. Despite the absence of KEV status, the risk profile is elevated by the public availability of a working proof-of-concept with a concrete request/response example in the GHSA advisory - even a mid-sized municipal IT team in inowroclaw operating a multi-tenant Flowise deployment should treat this as urgent, given the direct exposure of user PII and billing data subject to GDPR and PCI-adjacent compliance obligations. SSVC signals reinforce prompt remediation: the endpoint is network-accessible, the technical impact on confidentiality is high, and the exploitation bar is low for any authenticated platform user.

An authenticated Flowise cloud user intercepts their own legitimate request to the billing endpoint using a proxy tool such as Burp Suite, then replaces the customerId query parameter with Stripe-formatted IDs belonging to other registered customers (cus_XXXX) and replays the request using their own valid session cookie. The server returns a 200 OK with the full Stripe customer object for each valid ID - including email address, account balance, currency, and invoice settings - allowing the attacker to harvest PII and billing data at scale through enumeration. A working proof-of-concept demonstrating this exact technique, including a live request/response pair against cloud.flowiseai.com, is publicly documented in GHSA-2364-jh4q-m9vm.