CVE-2026-70476: Flowise billing IDOR lets tenants

Q: Is CVE-2026-70476 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-70476, increasing the risk of exploitation.

Q: How to fix CVE-2026-70476?

Upgrade Flowise to 3.1.3 or later immediately — the fix enforces that any subscriptionId passed to organization billing endpoints must belong to the authenticated user's own organization. If immediate upgrade isn't possible, restrict or disable multi-tenant self-service billing endpoints at the reverse proxy/WAF layer and require billing changes to go through a trusted admin path. Review Stripe subscription change logs and webhook history for any plan/seat modifications not tied to the legitimate account owner's session, and reconcile against `packages/server/src/enterprise/routes/organization.route.ts` behavior pre-patch. Going forward, monitor GitHub Advisory GHSA-gmmw-qg98-6j6p and the Flowise release notes given the package's high historical CVE volume (158 prior issues).

Q: What systems are affected by CVE-2026-70476?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, low-code/no-code AI orchestration platforms, multi-tenant SaaS AI platforms.

Q: What is the CVSS score for CVE-2026-70476?

No CVSS score has been assigned yet.

CISO Take

Flowise, a widely-used drag-and-drop platform for building LLM agent workflows, shipped organization billing endpoints that trust an attacker-supplied Stripe subscriptionId instead of verifying it belongs to the caller's own tenant, letting any authenticated user modify another organization's subscription plan or seat count. This is a classic broken object-level authorization (IDOR) bug rather than a novel AI attack, but it sits inside a multi-tenant SaaS platform used to orchestrate AI agents, so exploitation causes direct financial harm and service disruption to unrelated customers with nothing more than a valid login and a modified request. A public PoC already exists and the flaw ranks in the top 79% of CVEs by EPSS-modeled exploitation likelihood, though it is not in CISA KEV and CISA's own SSVC decision is TRACK_STAR (monitor, not urgent), so treat this as real but not an emergency. Any organization self-hosting or offering multi-tenant Flowise should upgrade to 3.1.3 immediately, since exploitation requires only an authenticated account and no elevated privileges, and should audit Stripe billing/webhook logs for subscription changes not initiated by the account owner.

Sources: NVD GitHub Advisory EPSS CISA KEV ATLAS

What is the risk?

Moderate risk. Exploitability is high in relative terms — the bug requires only a low-privilege authenticated account (no admin rights) and a trivially modified API request, and a public PoC exists, but there is no evidence of active mass exploitation, no CISA KEV listing, and CISA's SSVC decision (TRACK_STAR) signals monitor-not-urgent. Impact is confined to financial/billing integrity and service continuity for affected tenants rather than data confidentiality or code execution, which caps the ceiling relative to RCE-class AI framework bugs. Because Flowise has 158 other recorded CVEs and a package risk score of 0/100, this fits a pattern of a fast-moving, security-immature codebase — patch discipline and change monitoring matter more than for a single isolated flaw.

How does the attack unfold?

Initial Access

Attacker registers or uses an existing low-privilege authenticated account on a multi-tenant Flowise instance.

AML.T0012

Exploitation

Attacker submits a request to an organization billing endpoint with another tenant's Stripe subscriptionId instead of their own, bypassing the missing ownership check.

AML.T0049

Impact

The victim organization's Stripe subscription plan or seat quantity is altered without authorization, causing financial loss and disruption to their AI agent workflows.

AML.T0048.000

Initial Access

Attacker registers or uses an existing low-privilege authenticated account on a multi-tenant Flowise instance.

AML.T0012

Exploitation

Attacker submits a request to an organization billing endpoint with another tenant's Stripe subscriptionId instead of their own, bypassing the missing ownership check.

AML.T0049

Impact

The victim organization's Stripe subscription plan or seat quantity is altered without authorization, causing financial loss and disruption to their AI agent workflows.

AML.T0048.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	<= 3.1.2	`3.1.3`

Do you use Flowise? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.3%

chance of exploitation in 30 days

Higher than 25% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What should I do?

1 step

Upgrade Flowise to 3.1.3 or later immediately — the fix enforces that any subscriptionId passed to organization billing endpoints must belong to the authenticated user's own organization. If immediate upgrade isn't possible, restrict or disable multi-tenant self-service billing endpoints at the reverse proxy/WAF layer and require billing changes to go through a trusted admin path. Review Stripe subscription change logs and webhook history for any plan/seat modifications not tied to the legitimate account owner's session, and reconcile against packages/server/src/enterprise/routes/organization.route.ts behavior pre-patch. Going forward, monitor GitHub Advisory GHSA-gmmw-qg98-6j6p and the Flowise release notes given the package's high historical CVE volume (158 prior issues).

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Agent Framework AML.T0048.000 - Financial Harm AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

Annex A.6.2 - AI system security controls

NIST AI RMF

MANAGE-4.1 - Third-party and supply chain risk management

Frequently Asked Questions

What is CVE-2026-70476?

Flowise, a widely-used drag-and-drop platform for building LLM agent workflows, shipped organization billing endpoints that trust an attacker-supplied Stripe subscriptionId instead of verifying it belongs to the caller's own tenant, letting any authenticated user modify another organization's subscription plan or seat count. This is a classic broken object-level authorization (IDOR) bug rather than a novel AI attack, but it sits inside a multi-tenant SaaS platform used to orchestrate AI agents, so exploitation causes direct financial harm and service disruption to unrelated customers with nothing more than a valid login and a modified request. A public PoC already exists and the flaw ranks in the top 79% of CVEs by EPSS-modeled exploitation likelihood, though it is not in CISA KEV and CISA's own SSVC decision is TRACK_STAR (monitor, not urgent), so treat this as real but not an emergency. Any organization self-hosting or offering multi-tenant Flowise should upgrade to 3.1.3 immediately, since exploitation requires only an authenticated account and no elevated privileges, and should audit Stripe billing/webhook logs for subscription changes not initiated by the account owner.

Is CVE-2026-70476 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-70476, increasing the risk of exploitation.

How to fix CVE-2026-70476?

Upgrade Flowise to 3.1.3 or later immediately — the fix enforces that any subscriptionId passed to organization billing endpoints must belong to the authenticated user's own organization. If immediate upgrade isn't possible, restrict or disable multi-tenant self-service billing endpoints at the reverse proxy/WAF layer and require billing changes to go through a trusted admin path. Review Stripe subscription change logs and webhook history for any plan/seat modifications not tied to the legitimate account owner's session, and reconcile against `packages/server/src/enterprise/routes/organization.route.ts` behavior pre-patch. Going forward, monitor GitHub Advisory GHSA-gmmw-qg98-6j6p and the Flowise release notes given the package's high historical CVE volume (158 prior issues).

What systems are affected by CVE-2026-70476?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, low-code/no-code AI orchestration platforms, multi-tenant SaaS AI platforms.

What is the CVSS score for CVE-2026-70476?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworkslow-code/no-code AI orchestration platformsmulti-tenant SaaS AI platforms

MITRE ATLAS Techniques

AML.T0048.000 Financial Harm

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.6.2

NIST AI RMF: MANAGE-4.1

What are the technical details?

Original Advisory

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, several organization billing endpoints in packages/server/src/enterprise/routes/organization.route.ts and packages/server/src/enterprise/controllers/organization.controller.ts accept attacker-controlled Stripe subscriptionId values without verifying that the identifier belongs to the authenticated user's organization. An authenticated attacker can perform unauthorized Stripe subscription operations on other tenants, including changing subscription plans or modifying seat quantities, resulting in financial impact and service disruption. This issue is fixed in 3.1.3.

Exploitation Scenario

An attacker signs up for a legitimate, low-privilege account on a multi-tenant Flowise instance (their own trial or free-tier organization). Using the authenticated session, they enumerate or guess another organization's Stripe subscriptionId (which may be predictable, leaked, or discovered via other IDOR-adjacent endpoints) and submit it directly to the organization billing API instead of their own. Because the server never validates that the subscriptionId belongs to the caller's organization, the request succeeds, letting the attacker downgrade the victim's plan, reduce seat quantities, or otherwise manipulate billing — causing the victim's AI agent workflows to lose licensed capacity or their finance team to see unauthorized charges, without the attacker ever needing access to the victim's account credentials.

Weaknesses (CWE)

CWE-284 Improper Access Control Primary CWE-284 Improper Access Control Primary CWE-639 Authorization Bypass Through User-Controlled Key Primary CWE-639 Authorization Bypass Through User-Controlled Key Primary CWE-284 Improper Access Control CWE-639 Authorization Bypass Through User-Controlled Key

CWE-284 — Improper Access Control: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.