EUVD-2026-52872
GHSA-gmmw-qg98-6j6p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires a valid Flowise account (PR:L, not PR:N); no confidentiality impact; integrity is high via unauthorized cross-tenant Stripe subscription modification; low availability impact from service disruption.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, several organization billing endpoints in packages/server/src/enterprise/routes/organization.route.ts and packages/server/src/enterprise/controllers/organization.controller.ts accept attacker-controlled Stripe subscriptionId values without verifying that the identifier belongs to the authenticated user's organization. An authenticated attacker can perform unauthorized Stripe subscription operations on other tenants, including changing subscription plans or modifying seat quantities, resulting in financial impact and service disruption. This issue is fixed in 3.1.3.
AnalysisAI
Cross-tenant billing manipulation in Flowise's enterprise API allows any authenticated user to perform unauthorized Stripe subscription operations against other organizations by supplying an arbitrary victim subscriptionId to the /update-subscription-plan and /update-additional-seats endpoints. All Flowise enterprise deployments running versions prior to 3.1.3 are affected, with impact including unauthorized plan downgrades, seat-count inflation (inflating victim billing), and service disruption across tenants. No public exploit code or CISA KEV listing exists at time of analysis, but the vulnerability is mechanically straightforward given knowledge of a target organization's Stripe subscription identifier.
Technical ContextAI
Flowise is an open-source Node.js/TypeScript application (npm package: flowise) for building LLM-powered workflows via a drag-and-drop UI. The enterprise tier integrates with Stripe for subscription billing management. The root cause is CWE-284 (Improper Access Control): the controller methods updateSubscriptionPlan() and updateAdditionalSeats() in packages/server/src/enterprise/controllers/organization.controller.ts extract subscriptionId directly from req.body and forward it to the Stripe integration layer (identityManager.updateSubscriptionPlan / identityManager.updateAdditionalSeats) without asserting that the supplied identifier matches req.user.activeOrganizationSubscriptionId. This is a classic IDOR (Insecure Direct Object Reference) pattern where the server trusts client-supplied identifiers rather than resolving them from the authenticated session context. The CPE cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:* covers all Flowise versions up to and including 3.1.2.
RemediationAI
Upgrade Flowise to version 3.1.3 or later; this is the vendor-released patch confirmed via tagged release at https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3. The fix (PR #6321, commit 4d7899d02ca370a5510406be5c91483085a412f9) introduces a new assertStripeIdMatchesSession() utility in packages/server/src/enterprise/utils/tenantRequestGuards.ts that compares the request-supplied subscriptionId against req.user?.activeOrganizationSubscriptionId, returning HTTP 403 Forbidden on mismatch; the same guard is applied to customerId checks. If an immediate upgrade is not feasible, a compensating control is to block or authenticate access to the /organization/update-subscription-plan and /organization/update-additional-seats API routes at the reverse-proxy or WAF layer, permitting calls only from known administrative sources or backend services rather than end-user sessions; this reduces cross-tenant exposure but does not resolve the underlying flaw and will break self-service billing flows for legitimate users.
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Flowise versions before 3.0.1 allow unauthenticated access to the Custom MCPs feature, which is designed to execute OS c
FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. Una
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Flowise is a drag & drop user interface to build a customized large language model flow. Rated critical severity (CVSS 9
Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthent
Missing authentication on NVD data endpoint in Flowise before 3.0.13 allows unauthenticated access to internal vulnerabi
Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDat
Remote code execution in FlowiseAI Flowise before 3.1.3 lets an attacker execute arbitrary OS commands as the Flowise pr
Remote command execution in Flowise <= 3.1.2 lets an authenticated user break out of the vm2/@flowiseai/nodevm JavaScrip
Arbitrary file read and write in FlowiseAI Flowise (versions 2.2.8 through 3.0.5) lets remote unauthenticated attackers
Authenticated remote code execution in FlowiseAI Flowise prior to 3.1.2 allows any user with a valid session or API key
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today