Unauthorized Stripe Operations in Flowise by FlowiseAI
CVE-2026-70476

8.3HIGH

Key Information:

Vendor

Flowiseai

Status
Flowise
Vendor
CVE Published:
4 August 2026

What is CVE-2026-70476?

Flowise, a drag & drop interface for building customizable large language model flows, contains a vulnerability in its organizational billing endpoints. In versions before 3.1.3, these endpoints do not properly verify the ownership of the Stripe subscriptionId. This oversight allows authenticated attackers to manipulate subscriptions of other users' organizations, potentially leading to unauthorized plan changes and modifications to seat quantities. As a result, organizations can face significant financial repercussions and service disruptions. The issue has been addressed in version 3.1.3.

Affected Version(s)

Flowise < 3.1.2

References

https://github.com/FlowiseAI/Flowise/security/advisories/...
x_refsource_CONFIRM
https://github.com/FlowiseAI/Flowise/pull/6321
x_refsource_MISC
https://github.com/FlowiseAI/Flowise/commit/4d7899d02ca37...
x_refsource_MISC

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.