GHSA-gmmw-qg98-6j6p: Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation

Flowise has a broken access control vulnerability in its billing endpoints that allows an authenticated attacker to manipulate another organization's Stripe subscriptions. The vulnerable endpoints accept subscription identifiers directly from user input without checking that the subscription belongs to the attacker's organization, enabling unauthorized billing operations like changing subscription plans or seat quantities.