GHSA-GMMW-QG98-6J6P Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation

Summary Several organization billing endpoints accept attacker-controlled Stripe identifiers subscriptionId without verifying that the identifier belongs to the authenticated user's organization. This allows an authenticated attacker to perform unauthorized Stripe subscription operations on other...

CVE-2026-70476: Improper Access Control

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, several organization billing endpoints in packages/server/src/enterprise/routes/organization.route.ts and packages/server/src/enterprise/controllers/organization.controller.ts accept...

Draw organizer can rig the draw to favor certain participants such as their own account.

Lines of code Vulnerability details Description In RandomDraw, the host initiates a draw using startDraw or redraw if the redraw draw expiry has passed. Actual use of Chainlink oracle is done in requestRoll: request.currentChainlinkRequestId = coordinator.requestRandomWords keyHash:...

DoS after creating 100 raffles under one subscriptionID

Lines of code Vulnerability details Impact If a user adds new consumer, function VRFCoordinatorV2::addConsumer is called: function addConsumeruint64 subId, address consumer external override onlySubOwnersubId nonReentrant // Already maxed, cannot add any more consumers. if...

Malicious code in subscriptionid-apiversion (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5684f785ef82c798934c88950970276b80b0e16123d2b98b62fc04c4befbdc0d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6345 Malicious code in subscriptionid-apiversion (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5684f785ef82c798934c88950970276b80b0e16123d2b98b62fc04c4befbdc0d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...