CVE-2026-30823: Flowise has IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration

(updated )

The Flowise platform has a critical Insecure Direct Object Reference (IDOR) vulnerability combined with a Business Logic Flaw in the PUT /api/v1/loginmethod endpoint.

While the endpoint requires authentication, it fails to validate if the authenticated user has ownership or administrative rights over the target organizationId. This allows any low-privileged user (including “Free” plan users) to:

  1. Overwrite the SSO configuration of any other organization.
  2. Enable “Enterprise-only” features (SSO/SAML) without a license.
  3. Perform Account Takeover by redirecting the authentication flow.

References

Code Behaviors & Features

Detect and mitigate CVE-2026-30823 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →