Flowise Broken Access Control in Stripe Subscription Endpoints (Cross-Tenant Billing Manipulation)

Technical Analysis

The entry point is the '/update-subscription-plan' and '/update-additional-seats' REST routes in Flowise's enterprise organization controller, which read subscriptionId, newPlanId/quantity, and prorationDate directly from the request body and forward them to the Stripe integration layer via identityManager without checking that subscriptionId is associated with req.user.activeOrganization. An authenticated attacker who obtains or guesses another organization's Stripe subscription ID (e.g., via the organization read endpoint) can submit crafted requests to downgrade plans, zero out paid seats, or otherwise mutate a victim tenant's billing state. The vulnerability crosses tenant boundaries within the same application rather than agent-to-agent trust boundaries, but it demonstrates the broader pattern of agent/orchestration platforms exposing privileged backend operations (billing, provisioning) without object-level authorization checks, which is directly relevant to agentic platforms that manage multi-tenant resources programmatically.

Affected Systems

Flowise

Detection Signatures

• POST requests to /api/v1/organization/update-subscription-plan or /api/v1/organization/update-additional-seats containing a subscriptionId not matching the authenticated user's organization
• Repeated or anomalous billing-plan/seat-quantity change requests from a single authenticated session targeting multiple distinct subscriptionId values
• Audit logs showing organization A's subscriptionId referenced in requests authenticated under organization B's session/token

Remediation Steps

1. 1

   Enforce server-side subscription resolution

   Resolve the Stripe subscriptionId from the authenticated user's active organization on the server rather than accepting it as client input; ignore or reject any client-supplied subscriptionId that doesn't match.

2. 2

   Add object-level authorization checks

   Before executing any Stripe mutation (plan change, seat update), verify server-side that the subscription/organization mapping matches req.user.activeOrganization, returning 403 on mismatch.

3. 3

   Upgrade Flowise

   Apply the patched release beyond 3.1.2 that addresses GHSA-gmmw-qg98-6j6p/CVE-2026-70476.

4. 4

   Audit billing history

   Review Stripe subscription change logs for unexpected plan downgrades or seat quantity changes potentially caused by exploitation prior to patching.

5. 5

   Apply least-privilege API design

   Restructure billing endpoints to derive all sensitive identifiers from session/JWT claims instead of request bodies across all enterprise routes.