The vulnerability is an Insecure Direct Object Reference that allows an authenticated user to modify other users’ account settings. This can enable the attacker to take over an account and reconfigure Single Sign On settings to gain broader access, effectively bypassing enterprise‑grade restrictions. The impacted weakness corresponds to authorization bypass and credential mis‑management issues.

The affected product is FlowiseAI’s Flowise. The vendor’s CNA data does not specify affected versions, but the description states that versions prior to 3.0.13 are impacted.

With a CVSS score of 8.8, the vulnerability is considered High‑Severity. The EPSS score is below 1 %, indicating a very low probability of exploitation at this time, and the issue is not listed in the CISA KEV catalog. The likely attack path requires attacker authentication and access to the application’s API or web interface; once authenticated, the IDOR can be leveraged to modify or retrieve data belonging to other accounts, potentially enabling full control over those accounts.