---
id: CVE-2026-70476
title: >-
  Flowise is a drag & drop user interface to build a customized large language
  model flow
summary: >-
  Flowise is a drag & drop user interface to build a customized large language
  model flow. Prior to 3.1.3, several organization billing endpoints in
  packages/server/src/enterprise/routes/organization.route.ts and
  packages/server/src/enterp…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L'
cwe:
  - CWE-284
  - CWE-639
vendor: flowiseai
product: flowise
affected:
  - flowise < 3.1.3
patched:
  - flowise 3.1.3
published: '2026-08-04'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T21:09:17.230'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-70476'
references:
  - url: >-
      https://github.com/FlowiseAI/Flowise/commit/4d7899d02ca370a5510406be5c91483085a412f9
    label: security-advisories@github.com
  - url: 'https://github.com/FlowiseAI/Flowise/pull/6321'
    label: security-advisories@github.com
  - url: 'https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3'
    label: security-advisories@github.com
  - url: >-
      https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-gmmw-qg98-6j6p
    label: security-advisories@github.com
  - url: >-
      https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-gmmw-qg98-6j6p
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-gmmw-qg98-6j6p'
tags:
  - nvd
  - ghsa
  - npm
epss: 0.00518
epssPercentile: 0.41533
aliases:
  - GHSA-gmmw-qg98-6j6p
ecosystem: npm
ingestedAt: '2026-08-04T19:41:28.919Z'
---

## Overview

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, several organization billing endpoints in packages/server/src/enterprise/routes/organization.route.ts and packages/server/src/enterprise/controllers/organization.controller.ts accept attacker-controlled Stripe subscriptionId values without verifying that the identifier belongs to the authenticated user's organization. An authenticated attacker can perform unauthorized Stripe subscription operations on other tenants, including changing subscription plans or modifying seat quantities, resulting in financial impact and service disruption. This issue is fixed in 3.1.3.

## Affected

- `flowise < 3.1.3`

## Remediation

Upgrade past the affected range:

- `flowise 3.1.3`

## Package advisory (CVE-2026-70476)

Affected packages:

- `flowise <= 3.1.2`

Patched in:

- `flowise 3.1.3`

Source: https://github.com/advisories/GHSA-gmmw-qg98-6j6p