Flowise CVE-2026-70476

The attacker must hold a valid authenticated account on the same Flowise enterprise instance as the victim organization - this is an inherent prerequisite for reaching the billing endpoints, making single-tenant or self-hosted deployments with no external user accounts unexploitable. The vulnerable endpoints are present only in the enterprise tier (packages/server/src/enterprise/); community or self-hosted installations without the enterprise Stripe integration are not affected. The attacker must independently know or discover the target organization's Stripe subscriptionId (and/or customerId for some endpoints); this identifier is not exposed by default through the UI and must be obtained through reconnaissance, making opportunistic mass exploitation unlikely. The CVSS 4.0 vector's PR:N conflicts with the requirement for authentication - defenders should treat this as requiring at minimum a low-privilege account (PR:L). The AT:P designation in the CVSS 4.0 vector correctly reflects the subscriptionId prerequisite as a constraining attack requirement.

The published CVSS 4.0 score of 8.3 with vector AV:N/AC:L/AT:P/PR:N/UI:N reflects a network-accessible, low-complexity attack path. However, there is a material conflict: the vector specifies PR:N (no privileges required) while the CVE description and GHSA advisory explicitly require an authenticated attacker with a valid Flowise account. PR:L (low privileges) is the more accurate metric; this discrepancy should be verified with FlowiseAI before using the published vector for prioritization. AT:P (attack requirements present) correctly captures that the attacker must possess or discover a target organization's Stripe subscriptionId, which is a meaningful real-world constraint. No EPSS score was provided. No CISA KEV listing exists. No public POC has been announced. Despite the high CVSS score, exploitation is bounded to multi-tenant enterprise SaaS deployments of Flowise where multiple organizations coexist on the same instance; self-hosted single-tenant deployments face no cross-tenant risk. The financial and service-disruption impact is concrete and potentially severe for affected SaaS operators.

An attacker registers a legitimate account on a multi-tenant Flowise enterprise SaaS instance, then obtains a victim organization's Stripe subscriptionId through social engineering, API enumeration, or data leakage from another endpoint. The attacker sends a crafted POST request to /update-subscription-plan bearing the victim's subscriptionId and a lower-tier planId; the server forwards this directly to Stripe without ownership verification, causing the victim's subscription to be downgraded and disrupting their service. No public POC exists at time of analysis, but the attack requires no specialized tooling beyond a standard HTTP client.