CVE-2026-70476

Flowise before 3.1.3 fails to verify that Stripe subscription IDs supplied to its organization billing endpoints (packages/server/src/enterprise/routes/organization.route.ts and the corresponding controller) actually belong to the authenticated caller's organization, an authorization flaw (CWE-284/CWE-639, cross-tenant IDOR). An authenticated user on one tenant can supply another tenant's subscriptionId to change subscription plans or modify seat quantities, causing direct financial impact and service disruption to the victim organization. Any self-hosted or enterprise Flowise deployment running a version prior to 3.1.3 with the enterprise/multi-tenant billing features in use is affected. Exploitation has not been confirmed in the wild (not in CISA KEV, EPSS ~0.4%), but a public vendor advisory with proof-of-concept details (GHSA-gmmw-qg98-6j6p) is available.

What to do: Upgrade Flowise to 3.1.3 or later, which enforces ownership checks on subscriptionId values. In the meantime, restrict access to the enterprise organization billing endpoints to trusted administrators and review Stripe dashboards/logs for unexpected plan changes or seat-quantity modifications across subscriptions. Multi-tenant operators should ensure only vetted users hold accounts on shared instances.