CVE-2026-70476 FlowiseAI CVE debrief

Who should care

Users of Flowise, especially those with multiple tenants or organizations, should be aware of this vulnerability and take steps to protect their environments. This includes updating to version 3.1.3 or later, monitoring for suspicious subscription activities, and implementing proper authentication and authorization checks for subscription operations. Security teams and vulnerability management teams should prioritize this issue due to its high severity and potential impact on service and finances.

Technical summary

CVE-2026-70476 is a high-severity vulnerability in Flowise, a drag & drop user interface for building customized large language model flows. The issue, fixed in version 3.1.3, allows authenticated attackers to perform unauthorized Stripe subscription operations on other tenants by manipulating subscriptionId values in organization billing endpoints. This can lead to financial impact and service disruption. The vulnerability is caused by insufficient validation of subscriptionId values in packages/server/src/enterprise/routes/organization.route.ts and packages/server/src/enterprise/controllers/organization.controller.ts.

Defensive priority

Authenticated attackers may disrupt service and incur financial impact by manipulating Stripe subscriptions of other tenants.

Recommended defensive actions

• Verify and limit the validation of Stripe subscriptionId values in organization billing endpoints.
• Implement proper authentication and authorization checks for subscription operations.
• Monitor for and restrict unauthorized changes to subscription plans and seat quantities.
• Update to Flowise version 3.1.3 or later to apply the fix.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE-2026-70476 issue involves unauthorized Stripe subscription operations due to insufficient validation of subscriptionId in Flowise's organization billing endpoints. Evidence is based on official CVE and NVD records, and source references from [email protected]. The vulnerability allows authenticated attackers to perform unauthorized actions on other tenants, potentially leading to financial impact and service disruption. To verify and mitigate this issue, defenders should review the official advisory, assess their exposure, and update to version 3.1.3 or later. They should also monitor for suspicious subscription activities and implement proper authentication and authorization checks.

Official resources