Vulnerability · Published Aug 4, 2026 · Assigned by GitHub_M

CVE-2026-70476Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation

High 8.3

In plain English

A high-severity improper access control in Flowise from FlowiseAI. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.3High

Exploit odds (30 days)0.5%top 55.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, several organization billing endpoints in packages/server/src/enterprise/routes/organization.route.ts and packages/server/src/enterprise/controllers/organization.controller.ts accept attacker-controlled Stripe subscriptionId values without verifying that the identifier belongs to the authenticated user's organization. An authenticated attacker can perform unauthorized Stripe subscription operations on other tenants, including changing subscription plans or modifying seat quantities, resulting in financial impact and service disruption. This issue is fixed in 3.1.3.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	flowise	3.1.3	GHSA-gmmw-qg98-6j6p

Affected products (as reported)

Vendor	Product	Versions
FlowiseAI	Flowise	< 3.1.2

Weakness: CWE-284, CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

References

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-gmmw-qg98-6j6p x_refsource_CONFIRM
https://github.com/FlowiseAI/Flowise/pull/6321 x_refsource_MISC
https://github.com/FlowiseAI/Flowise/commit/4d7899d02ca370a5510406be5c91483085a412f9 x_refsource_MISC
https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3 x_refsource_MISC