{"data":{"id":"24b11b12-aacf-4389-807d-853d304f57bc","title":"GHSA-gmmw-qg98-6j6p: Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation","summary":"GHSA-gmmw-qg98-6j6p reports broken access control in Flowise's organization billing endpoints, /api/v1/organization/update-subscription-plan and /api/v1/organization/update-additional-seats in packages/server/src/enterprise. The controllers take subscriptionId from the request body and never check that it belongs to the caller's activeOrganization. An authenticated user can therefore change another organization's Stripe subscription plan or seat quantity, with possible unintended charges or service downgrades.","solution":"N/A -- no mitigation discussed in source.","labels":["security","industry"],"sourceUrl":"https://github.com/advisories/GHSA-gmmw-qg98-6j6p","publishedAt":"2026-08-04T19:24:07.000Z","cveId":"CVE-2026-70476","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["flowise@<= 3.1.2 (fixed: 3.1.3)"],"affectedPackageNames":["flowise"],"affectedPackageRefs":["npm:flowise"],"affectedVendors":[],"affectedVendorsRaw":["Flowise"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00518,"epssCheckedAt":"2026-11-04T00:12:27.430Z","kevDateAdded":null,"advisoryAliases":["GHSA-gmmw-qg98-6j6p"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-08-04T19:24:07.000Z","fixReleasedAt":"2026-06-25T10:41:14.612Z","daysToFix":-40,"fixCheckedAt":"2026-10-29T21:32:09.381Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"flowise","fixedVersion":"3.1.3","matchedVersion":"3.1.3","fixReleasedAt":"2026-06-25T10:41:14.612Z","daysToFix":-40,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:32:09.233Z"}]}}