CVE-2026-70476 in Flowise
Summary
by MITRE • 08/04/2026
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, several organization billing endpoints in packages/server/src/enterprise/routes/organization.route.ts and packages/server/src/enterprise/controllers/organization.controller.ts accept attacker-controlled Stripe subscriptionId values without verifying that the identifier belongs to the authenticated user's organization. An authenticated attacker can perform unauthorized Stripe subscription operations on other tenants, including changing subscription plans or modifying seat quantities, resulting in financial impact and service disruption. This issue is fixed in 3.1.3.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
This vulnerability resides within Flowise version 3.1.2 and earlier, where the enterprise billing functionality contains a critical access control flaw that enables authenticated attackers to manipulate Stripe subscription identifiers belonging to other organizations. The vulnerability specifically affects endpoints located in packages/server/src/enterprise/routes/organization.route.ts and packages/server/src/enterprise/controllers/organization.controller.ts, which process organization billing operations without proper user authorization verification. The flaw stems from insufficient input validation and authentication checks when processing attacker-controlled Stripe subscriptionId values, allowing unauthorized access to subscription management functions.
The technical implementation of this vulnerability demonstrates a classic case of insufficient authorization checking, classified as CWE-862 - Missing Authorization, which falls under the broader category of privilege escalation vulnerabilities. Attackers can exploit this weakness by crafting malicious requests that target specific Stripe subscription identifiers, bypassing normal organizational boundaries and gaining access to billing operations for other tenants within the same system. This represents a direct violation of the principle of least privilege and demonstrates inadequate separation of concerns between different organizational entities within the multi-tenant architecture.
The operational impact of this vulnerability extends beyond simple unauthorized access, as authenticated attackers can perform significant financial operations on behalf of other organizations. The compromised endpoints enable manipulation of subscription plans, modification of seat quantities, and potentially complete subscription cancellation or termination, all while maintaining the appearance of legitimate administrative activity. This creates substantial risk for both financial loss through unauthorized billing changes and service disruption that could affect multiple customers within the same system instance, as demonstrated by the ATT&CK technique T1078 - Valid Accounts and T1496 - Resource Hijacking which often involve unauthorized access to billing and subscription management systems.
Organizations using Flowise versions prior to 3.1.3 face significant exposure to financial fraud and service disruption attacks that could result in substantial monetary losses and damage to customer relationships. The vulnerability creates a persistent threat vector that remains active as long as affected versions are deployed, making it particularly dangerous for cloud service providers or SaaS offerings that host multiple tenant organizations within the same infrastructure. Security teams should immediately implement mitigations including immediate version upgrades to 3.1.3 or later, along with monitoring for unauthorized subscription changes and implementing additional access controls around billing endpoints.
The fix implemented in Flowise version 3.1.3 addresses this vulnerability by introducing proper authorization verification mechanisms that ensure Stripe subscription identifiers can only be manipulated by users authenticated to the corresponding organization. This represents a critical security enhancement that validates user permissions before processing any subscription management operations, effectively closing the access control gap that previously allowed cross-tenant subscription manipulation. Organizations should conduct immediate security audits of their deployment environments to verify all instances have been updated and should implement continuous monitoring for similar authorization flaws in other enterprise applications that handle multi-tenant billing operations, as such vulnerabilities often remain undetected due to the complexity of multi-tenant system architectures.