CVE-2026-70476: Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation
Several organization billing endpoints accept attacker-controlled Stripe identifiers (subscriptionId) without verifying that the identifier belongs to the authenticated user’s organization. This allows an authenticated attacker to perform unauthorized Stripe subscription operations on other tenants. As a result, an authenticated user can manipulate the Stripe subscription of another organization by supplying a victim organization’s subscriptionId.
This allows attackers to perform unauthorized billing operations such as changing subscription plans or modifying seat quantities, resulting in potential financial impact and service disruption.
References
- github.com/FlowiseAI/Flowise/commit/4d7899d02ca370a5510406be5c91483085a412f9
- github.com/FlowiseAI/Flowise/pull/6321
- github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3
- github.com/FlowiseAI/Flowise/security/advisories/GHSA-gmmw-qg98-6j6p
- github.com/advisories/GHSA-gmmw-qg98-6j6p
- nvd.nist.gov/vuln/detail/CVE-2026-70476
Code Behaviors & Features
Detect and mitigate CVE-2026-70476 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →