Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation
Flowise
More for Flowise RSS feed for Flowise
- Severity
- High, CVSS 8.2
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
- Record
- CVE-2026-70476
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 4, 2026
- Source last modified
- October 24, 2026
Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, several organization billing endpoints in packages/server/src/enterprise/routes/organization.route.ts and packages/server/src/enterprise/controllers/organization.controller.ts accept attacker-controlled Stripe subscriptionId values without verifying that the identifier belongs to the authenticated user's organization. An authenticated attacker can perform unauthorized Stripe subscription operations on other tenants, including changing subscription plans or modifying seat quantities, resulting in financial impact and service disruption. This issue is fixed in 3.1.3.
Description quoted from the NVD record.
Who is affected
Flowise is a drag-and-drop tool for building apps that use AI language models. This flaw affects versions before 3.1.3, in the organization billing features that manage paid subscriptions through Stripe, an online payment service. A person who has an account and is logged in could change the subscription plans or the number of paid seats belonging to other organizations that share the same Flowise installation. This could cost those organizations money and disrupt their service. This flaw is rated High.
What to do
- Find out who looks after Flowise for your organization: the person who installed or runs it, or the IT provider or vendor who manages it for you.
- If someone in your organization runs Flowise, ask them to update it to version
3.1.3or later, which fixes this flaw. Any installation running a version before 3.1.3 needs the update. - If an IT provider or vendor runs Flowise for your organization, send them this advisory and ask when the update to
3.1.3will be done.
Analysis written from the source record as of October 24, 2026 and reviewed before publishing.