CVE-2026-70476

Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation

Published Aug 4, 2026 CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Description

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, several organization billing endpoints in packages/server/src/enterprise/routes/organization.route.ts and packages/server/src/enterprise/controllers/organization.controller.ts accept attacker-controlled Stripe subscriptionId values without verifying that the identifier belongs to the authenticated user's organization. An authenticated attacker can perform unauthorized Stripe subscription operations on other tenants, including changing subscription plans or modifying seat quantities, resulting in financial impact and service disruption. This issue is fixed in 3.1.3.

Analysis

Technical impact

Flowise versions prior to 3.1.3 allow authenticated users to supply arbitrary Stripe subscriptionId values when calling organization‑billing endpoints without checking that the subscription belongs to their tenant. The flaw permits an attacker to change subscription plans, alter seat quantities, or otherwise perform Stripe operations on other tenants, causing direct financial damage and potential service disruption.

Affected Systems

The affected product is FlowiseAI Flowise. All releases before 3.1.3 are vulnerable; 3.1.3 and later include the fix.

Risk and Exploitability

The CVSS score of 8.3 indicates high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, so the current exploitation probability is uncertain. An attacker must be an authenticated user in the system; from that race condition, they can manipulate other tenants’ billing by sending crafted requests to the existing endpoints.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

FlowiseAI

Flowise

affected

Version	Status	Constraints
`< 3.1.2`	affected	—

Configuration 1 [-]

cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Flowiseai

Flowise

Version	Status	Scheme	Platform
`[0,3.1.2)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the official Flowise patch to version 3.1.3 or newer.
Ensure that only authenticated users can reach the subscription‑management endpoints and that their session does not expose cross‑tenant privileges.
Implement server‑side validation that the provided Stripe subscriptionId belongs to the requesting organization before performing any Stripe operation.

Generated by OpenCVE AI on August 4, 2026 at 20:26 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-gmmw-qg98-6j6p	Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.518% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/FlowiseAI/Flowise/commit/4d7899d02ca370a5510406be5c91483085a412f9
https://github.com/FlowiseAI/Flowise/pull/6321
https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-gmmw-qg98-6j6p

History

Sep 11, 2026 11:45 PM Affected versions updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:flowiseai:flowise::::::::
Metrics		cvssV3_1 `{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L'}`

Aug 5, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 4, 2026 8:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Flowiseai Flowiseai flowise
Vendors & Products		Flowiseai Flowiseai flowise

Aug 4, 2026 7:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, several organization billing endpoints in packages/server/src/enterprise/routes/organization.route.ts and packages/server/src/enterprise/controllers/organization.controller.ts accept attacker-controlled Stripe subscriptionId values without verifying that the identifier belongs to the authenticated user's organization. An authenticated attacker can perform unauthorized Stripe subscription operations on other tenants, including changing subscription plans or modifying seat quantities, resulting in financial impact and service disruption. This issue is fixed in 3.1.3.
Title		Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation
Weaknesses		CWE-284 CWE-639
References		https://github.com/FlowiseAI/Flowise/commit/4d7899d02ca370a5510406be5c91483085a412f9 https://github.com/FlowiseAI/Flowise/pull/6321 https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3 https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-gmmw-qg98-6j6p
Metrics		cvssV4_0 `{'score': 8.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N'}`