CyberRota Analysis
AI-GeneratedThe vulnerability affects Flowise versions prior to 3.1.3, specifically in the billing endpoints that improperly handle Stripe subscriptionId values, allowing authenticated attackers to manipulate subscription operations across different organizations. This can lead to unauthorized changes in subscription plans and seat quantities, potentially causing significant financial repercussions and service disruptions. Organizations using affected versions should prioritize upgrading to 3.1.3 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, several organization billing endpoints in packages/server/src/enterprise/routes/organization.route.ts and packages/server/src/enterprise/controllers/organization.controller.ts accept attacker-controlled Stripe subscriptionId values without verifying that the identifier belongs to the authenticated user's organization. An authenticated attacker can perform unauthorized Stripe subscription operations on other tenants, including changing subscription plans or modifying seat quantities, resulting in financial impact and service disruption. This issue is fixed in 3.1.3.