CVE-2023-45893 is a high severity (CVSS 7.5) insecure direct object reference in Floorsight Customer Portal Q3 2023. An unauthenticated remote attacker can view sensitive customer information through the order and invoice pages. The record names no fixed version, so restrict access and check with the vendor.
What's affected
The record names Floorsight Customer Portal in the Q3 2023 release. The vendor is Floorsight Software. The record gives no version range beyond that quarter and no fixed release, and the only reference is a public write-up on GitHub. We read the write-up for the sibling Insights product, which says affected versions are Q3 2023 and below. Do not assume the portal write-up says more; check it yourself.
The description calls out an indirect object reference, meaning the page trusts an identifier supplied by the caller. The related Insights record is CVE-2023-45892.
The NVD record scores it 7.5 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The weakness class is CWE-639 (authorization bypass through user-controlled key). The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
This is an application, so there is nothing to query with a package manager. Confirm with your vendor contact whether you run Floorsight Customer Portal and which release you are on.
If you do, test your own portal from outside the network without signing in, and see whether order or invoice pages return data. Only test systems you own or are allowed to test. Then search web logs for unauthenticated requests to those pages from addresses you do not recognise.
What to do now
- Ask Floorsight whether Customer Portal Q3 2023 is fixed and what release to move to.
- Restrict the portal to known users with a VPN, an allow list or an identity aware proxy until you have an answer.
- Review logs for sequential or repeated requests to order and invoice pages with no session.
- Assess whether customer data was read and follow your notification obligations if it was.
- Add the portal to your software inventory with its version.
Why it matters
An insecure direct object reference happens when an application uses a value from the request, such as an id, to look up a record and never checks that the caller owns it. The record maps it to CWE-639. With no login required, the exposure reaches anyone on the internet.
Portals that hold orders and invoices carry names, addresses and purchase history. Even without payment data, that is enough for fraud and phishing. The durable fix is a server side ownership check on every lookup.
Quick check
Is this the same bug as CVE-2023-45892?
They are the same class of flaw in two Floorsight products, Insights and Customer Portal, with separate CVE records.
Can I rely on hiding the page URL?
No. Obscure paths are not access control. Require authentication and check record ownership on the server.
Sources
Last reviewed: 19 October 2026.
