CVE-2026-70476

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3

Description Several organization billing endpoints accept attacker-controlled Stripe identifiers without verifying that the identifier belongs to the authenticated user's organization. This allows an authenticated attacker to perform unauthorized Stripe subscription operations on other tenants, such as changing subscription plans or modifying seat quantities, which can lead to financial impact and service disruption. The issue occurs because the server trusts the user-supplied subscriptionId and forwards it to the Stripe integration layer without validating ownership.

API Endpoints: '/api/v1/organization/update-subscription-plan' '/api/v1/organization/update-additional-seats'

Vulnerable Parameters or Variables: subscriptionId

Function Names: updateSubscriptionPlan() updateAdditionalSeats()

Recommendations Update to version 3.1.3. As a temporary workaround, restrict access to the '/api/v1/organization/update-subscription-plan' and '/api/v1/organization/update-additional-seats' endpoints to minimize the risk of exploitation.