FlowiseAI Flowise up to 3.1.2 Billing organization.controller.ts subscriptionId improper authorization

Summaryinfo

A vulnerability was found in FlowiseAI Flowise up to 3.1.2. It has been classified as problematic. Impacted is an unknown function of the file packages/server/src/enterprise/routes/organization.route.ts/packages/server/src/enterprise/controllers/organization.controller.ts of the component Billing. Performing a manipulation of the argument subscriptionId results in improper authorization. This vulnerability is cataloged as CVE-2026-70476. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability classified as problematic has been found in FlowiseAI Flowise up to 3.1.2. This affects an unknown code block of the file packages/server/src/enterprise/routes/organization.route.ts/packages/server/src/enterprise/controllers/organization.controller.ts of the component Billing. The manipulation of the argument subscriptionId with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on integrity, and availability. The summary by CVE is:

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, several organization billing endpoints in packages/server/src/enterprise/routes/organization.route.ts and packages/server/src/enterprise/controllers/organization.controller.ts accept attacker-controlled Stripe subscriptionId values without verifying that the identifier belongs to the authenticated user's organization. An authenticated attacker can perform unauthorized Stripe subscription operations on other tenants, including changing subscription plans or modifying seat quantities, resulting in financial impact and service disruption. This issue is fixed in 3.1.3.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-70476 since 08/04/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1548.002 for this issue.

Upgrading to version 3.1.3 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• FlowiseAI

Name

• Flowise

Version

• 3.1.0
• 3.1.1
• 3.1.2

Website

• Product: https://github.com/FlowiseAI/Flowise/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion