{
 "id": "AIR-2026-1276",
 "slug": "cve-2026-73488-insecure-direct-object-reference-in-flowise-c",
 "title": "CVE-2026-73488: Insecure direct object reference in Flowise customer endpoint",
 "summary": "Flowise contains an insecure direct object reference vulnerability that allows authenticated attackers to access other customers' payment and profile data. Attackers can manipulate customer IDs to retrieve sensitive billing information.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Flowise"
 ],
 "incident_date": "2026-08-13",
 "incident_date_precision": "day",
 "first_reported": "2026-08-13",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73488",
   "publisher": "NVD",
   "title": "CVE-2026-73488: Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET…",
   "published_at": "2026-08-13"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-73488",
  "idor"
 ],
 "created_at": "2026-10-18T10:04:21.885Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}