CVE-2026-70476 is a high severity (CVSS 8.2) authorization flaw in Flowise before 3.1.3. Organization billing endpoints accept a Stripe subscriptionId without checking that it belongs to the caller's organization, so one tenant can change another's plan or seats. The fix is Flowise 3.1.3.
What's affected
Flowise (npm package flowise) versions up to and including 3.1.2, fixed in 3.1.3, per the GitHub advisory. The affected code is in the enterprise organization routes and controller.
The weaknesses are CWE-284 (improper access control) and CWE-639 (authorization bypass through a user-controlled key). Endpoints such as update-subscription-plan and update-additional-seats take subscriptionId from the request body and act on it without resolving the subscription from the authenticated user's organization.
The record's vector shows no privileges required, while the advisory says an authenticated attacker. Both place the flaw behind the billing feature, which is in the enterprise code path. If you run Flowise without the enterprise billing features, check whether these routes are reachable in your build.
How to check if you're exposed
Check the installed version. For an npm install:
npm ls flowise
For Docker, read the image tag you run, and check the version shown in the Flowise interface. Anything before 3.1.3 is affected.
Then look at how you run it. The Flowise maintainers announced they are sunsetting the project, with the repository archived on 10 August 2026 and the npm packages and Docker images marked deprecated. The sunset page states that the code stays available under Apache 2.0 for forks. If you stay on Flowise, you own the patching, so plan who does it.
free in-browser dependency scan reads a package manifest in your browser and shows known vulnerabilities, including this one for the flowise npm package.
What to do now
- Check your Flowise version with npm ls flowise or the image tag.
- Upgrade to 3.1.3 or later, or to the build your fork maintains.
- Decide whether to stay on a project that is being wound down, or migrate.
- Review access logs for the affected routes for requests you do not recognize.
- Rotate any credentials stored in Flowise that other workspaces could have reached.
Why it matters
CWE-639 is the classic insecure direct object reference: the client names the object, and the server believes it. Billing makes the stakes concrete. Changing seat counts or plans on another tenant's Stripe subscription causes cost and can disrupt service.
The safe design is to never accept an external object id for something the server can look up. The server already knows the caller's organization, so it can find that organization's subscription itself.
Quick check
Does this affect self-hosted Flowise without billing?
The advisory places the flaw in the enterprise organization billing routes. Check whether those routes exist and are reachable in your build, and upgrade regardless.
Sources
Last reviewed: 18 October 2026.
