CVE-2026-70476 is a cross-tenant authorization bypass in Flowise's Stripe subscription integration. The vulnerability stems from a namespace boundary failure: Flowise accepted Stripe's subscriptionId as a valid authorization token for multi-tenant operations without verifying which Flowise organization actually owned that subscription. Stripe's API validates that a caller can manipulate a subscription within Stripe's system — but Flowise never established the critical server-side mapping between subscriptionId and organization, so any authenticated user could modify billing for any other tenant in the system.
If your Flowise deployment uses the enterprise tier with Stripe billing, check whether your subscription-to-organization relationships are being validated server-side before any Stripe API call. The fix pattern requires maintaining an internal mapping table that Flowise controls — the subscriptionId alone should never authorize cross-tenant operations, regardless of whether the request originated with valid Stripe credentials.
The critical uncertainty: if Flowise maintained this mapping internally but the vulnerable endpoints simply ignored it, that's architectural bitrot requiring a surgical fix to reconnect authorization logic to existing data structures. If no mapping existed at all, the entire billing integration was built on the assumption that Stripe's object model carried Flowise's tenant semantics — a structural flaw requiring a fundamental rework of how billing identifiers are anchored to organizations.
Detection is challenging because subscription changes don't generate security alerts — they surface as billing discrepancies on the next invoice cycle. Review your Flowise audit logs for subscription modification API calls and correlate with your Stripe billing statements to identify unauthorized changes. Given the CVSS 8.3 and the direct financial impact (seat manipulation, tier downgrades, subscription hijacking for fraudulent upgrades), treat this as high-priority even though it requires authentication — the exploit is silent, persistent, and has direct monetary consequences.