CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
5346 vulnerabilities reference this CWE, most recent first.
GHSA-GJ9J-5PFX-GC7P
Vulnerability from github – Published: 2026-08-27 12:30 – Updated: 2026-08-27 12:30If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak SID as sole authenticator. An attacker can brute-force the SID, recover another session's handle number, and read license information belonging to another handle.
{
"affected": [],
"aliases": [
"CVE-2026-81576"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-27T10:16:40Z",
"severity": "HIGH"
},
"details": "If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak\nSID as sole authenticator. An attacker can brute-force the SID, recover another session\u0027s handle number, and read\nlicense information belonging to another handle.",
"id": "GHSA-gj9j-5pfx-gc7p",
"modified": "2026-08-27T12:30:26Z",
"published": "2026-08-27T12:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81576"
},
{
"type": "WEB",
"url": "https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-103401.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GJCF-776G-8W8G
Vulnerability from github – Published: 2024-08-27 18:31 – Updated: 2024-08-30 15:31An Insecure Direct Object Reference (IDOR) in PTC ThingWorx v9.5.0 allows attackers to view sensitive information, including PII, regardless of access level.
{
"affected": [],
"aliases": [
"CVE-2024-40395"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-27T16:15:07Z",
"severity": "MODERATE"
},
"details": "An Insecure Direct Object Reference (IDOR) in PTC ThingWorx v9.5.0 allows attackers to view sensitive information, including PII, regardless of access level.",
"id": "GHSA-gjcf-776g-8w8g",
"modified": "2024-08-30T15:31:26Z",
"published": "2024-08-27T18:31:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40395"
},
{
"type": "WEB",
"url": "https://pastebin.com/9dc4LYGA"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GJG3-3X79-MXH4
Vulnerability from github – Published: 2023-07-06 21:14 – Updated: 2025-02-13 18:31NGINX Management Suite may allow an authenticated attacker to gain access to configuration objects outside of their assigned environment.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
{
"affected": [],
"aliases": [
"CVE-2023-28656"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-03T15:15:12Z",
"severity": "HIGH"
},
"details": "NGINX Management Suite may allow an authenticated attacker to gain access to configuration objects outside of their assigned environment.\u00a0\u00a0\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",
"id": "GHSA-gjg3-3x79-mxh4",
"modified": "2025-02-13T18:31:34Z",
"published": "2023-07-06T21:14:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28656"
},
{
"type": "WEB",
"url": "https://my.f5.com/manage/s/article/K000133417"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20230609-0006"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GJGJ-4946-RQM5
Vulnerability from github – Published: 2026-09-02 06:31 – Updated: 2026-09-02 12:31The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an incomplete fix of CVE-2026-9180: the deletion remains reachable on sites using payment confirmation, confirmed through version 2.4.7.
{
"affected": [],
"aliases": [
"CVE-2026-15232"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-02T06:17:16Z",
"severity": "MODERATE"
},
"details": "The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users\u0027 reservations. This is an incomplete fix of CVE-2026-9180: the deletion remains reachable on sites using payment confirmation, confirmed through version 2.4.7.",
"id": "GHSA-gjgj-4946-rqm5",
"modified": "2026-09-02T12:31:26Z",
"published": "2026-09-02T06:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15232"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/b0ffa74d-a03a-4eed-95c7-579360990d7f"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GJV9-RQ5C-JPXW
Vulnerability from github – Published: 2026-09-15 21:31 – Updated: 2026-09-15 21:31An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive information via the add-to-cart API and the downloadable fulfilment components.
{
"affected": [],
"aliases": [
"CVE-2026-79409"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-15T19:17:39Z",
"severity": "MODERATE"
},
"details": "An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive information via the add-to-cart API and the downloadable fulfilment components.",
"id": "GHSA-gjv9-rq5c-jpxw",
"modified": "2026-09-15T21:31:20Z",
"published": "2026-09-15T21:31:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79409"
},
{
"type": "WEB",
"url": "https://github.com/isukasanuj/bagisto-cve/blob/main/CVE-2026-79409.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GJWW-PW6X-33CC
Vulnerability from github – Published: 2026-10-02 12:31 – Updated: 2026-10-02 12:31Authorization Bypass Through User-Controlled Key vulnerability in ThimPress LearnPress allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects LearnPress: from n/a through 4.4.9.
{
"affected": [],
"aliases": [
"CVE-2026-104403"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-02T10:17:06Z",
"severity": "MODERATE"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in ThimPress LearnPress allows Exploiting Incorrectly Configured Access Control Security Levels.\n\nThis issue affects LearnPress: from n/a through 4.4.9.",
"id": "GHSA-gjww-pw6x-33cc",
"modified": "2026-10-02T12:31:10Z",
"published": "2026-10-02T12:31:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104403"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/learnpress/vulnerability/wordpress-learnpress-plugin-4-4-9-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GJWX-PWX3-4HXQ
Vulnerability from github – Published: 2026-09-01 18:30 – Updated: 2026-09-01 18:30GROWI contains an access control vulnerability in the GET /_api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revision identified by the path parameter without confirming they reference the same page. Authenticated attackers can pair a page identifier they can access with an arbitrary revision identifier to read revision content from pages they lack permission to view.
{
"affected": [],
"aliases": [
"CVE-2026-84205"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-01T16:17:35Z",
"severity": "HIGH"
},
"details": "GROWI contains an access control vulnerability in the GET /_api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revision identified by the path parameter without confirming they reference the same page. Authenticated attackers can pair a page identifier they can access with an arbitrary revision identifier to read revision content from pages they lack permission to view.",
"id": "GHSA-gjwx-pwx3-4hxq",
"modified": "2026-09-01T18:30:44Z",
"published": "2026-09-01T18:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84205"
},
{
"type": "WEB",
"url": "https://github.com/growilabs/growi/pull/11810"
},
{
"type": "WEB",
"url": "https://github.com/growilabs/growi/commit/d298e0b1dbbf568c99db657fa0f7e90f72ddc59b"
},
{
"type": "WEB",
"url": "https://github.com/growilabs/growi"
},
{
"type": "WEB",
"url": "https://github.com/growilabs/growi/blob/v8.0.2/apps/app/src/server/routes/apiv3/revisions.js"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/growi-through-8.0.2-authorization-bypass-through-user-controlled-key-on-apiv3-revision-retrieval"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-GJX6-H8HM-C9RQ
Vulnerability from github – Published: 2025-08-21 00:30 – Updated: 2026-05-07 05:23A vulnerability was found in Xuxueli xxl-job up to 3.1.1. Affected by this issue is the function remove of the file /src/main/java/com/xxl/job/admin/controller/JobInfoController.java of the component Jobs Handler. Performing manipulation of the argument ID results in improper control of resource identifiers. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.1.1"
},
"package": {
"ecosystem": "Maven",
"name": "com.xuxueli:xxl-job-admin"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-9264"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-99"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-07T05:23:26Z",
"nvd_published_at": "2025-08-21T00:15:29Z",
"severity": "LOW"
},
"details": "A vulnerability was found in Xuxueli xxl-job up to 3.1.1. Affected by this issue is the function remove of the file /src/main/java/com/xxl/job/admin/controller/JobInfoController.java of the component Jobs Handler. Performing manipulation of the argument ID results in improper control of resource identifiers. Remote exploitation of the attack is possible. The exploit has been made public and could be used.",
"id": "GHSA-gjx6-h8hm-c9rq",
"modified": "2026-05-07T05:23:26Z",
"published": "2025-08-21T00:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9264"
},
{
"type": "WEB",
"url": "https://github.com/xuxueli/xxl-job/issues/3773"
},
{
"type": "WEB",
"url": "https://github.com/xuxueli/xxl-job/issues/3773#issue-3308389841"
},
{
"type": "PACKAGE",
"url": "https://github.com/xuxueli/xxl-job"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.320806"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.320806"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.631728"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "xxl-job Jobs Handler remove function allows improper control of resource identifiers via ID parameter"
}
GHSA-GM3X-2X46-FC3V
Vulnerability from github – Published: 2026-10-16 18:34 – Updated: 2026-10-16 18:34FastBee through 2.1.0 contains an insecure direct object reference vulnerability that allows authenticated low-privilege users to access other users' device groups because GroupController queries lack owner checks. Attackers, including self-registered users, can supply sequential group IDs to read, overwrite, reassign, rewrite device associations of, or delete other users' groups.
{
"affected": [],
"aliases": [
"CVE-2026-111654"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-16T18:17:46Z",
"severity": "MODERATE"
},
"details": "FastBee through 2.1.0 contains an insecure direct object reference vulnerability that allows authenticated low-privilege users to access other users\u0027 device groups because GroupController queries lack owner checks. Attackers, including self-registered users, can supply sequential group IDs to read, overwrite, reassign, rewrite device associations of, or delete other users\u0027 groups.",
"id": "GHSA-gm3x-2x46-fc3v",
"modified": "2026-10-16T18:34:47Z",
"published": "2026-10-16T18:34:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111654"
},
{
"type": "WEB",
"url": "https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-open-api/src/main/java/com/fastbee/data/controller/GroupController.java#L70-L137"
},
{
"type": "WEB",
"url": "https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-service/fastbee-iot-service/src/main/java/com/fastbee/iot/service/impl/GroupServiceImpl.java#L37-L143"
},
{
"type": "WEB",
"url": "https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-service/fastbee-iot-service/src/main/resources/mapper/iot/GroupMapper.xml#L36-L109"
},
{
"type": "WEB",
"url": "https://hackmd.io/@hieuPenguinnn/fastbee-device-group-cross-user-idor"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/fastbee-through-2.1.0-idor-via-iot-group-by-id-endpoints"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-GMMW-QG98-6J6P
Vulnerability from github – Published: 2026-08-04 19:24 – Updated: 2026-08-04 19:24Summary
Several organization billing endpoints accept attacker-controlled Stripe identifiers (subscriptionId) without verifying that the identifier belongs to the authenticated user's organization. This allows an authenticated attacker to perform unauthorized Stripe subscription operations on other tenants. As a result, an authenticated user can manipulate the Stripe subscription of another organization by supplying a victim organization's subscriptionId.
This allows attackers to perform unauthorized billing operations such as changing subscription plans or modifying seat quantities, resulting in potential financial impact and service disruption.
Details
Multiple organization billing endpoints accept subscriptionId directly from user input without validating ownership. The server relies on a client-supplied Stripe subscription identifier rather than resolving the subscription from the authenticated user's organization context.
File
packages/server/src/enterprise/routes/organization.route.ts
Affected routes:
router.post('/update-additional-seats', organizationController.updateAdditionalSeats)
router.post('/update-subscription-plan', organizationController.updateSubscriptionPlan)
updateSubscriptionPlan
File
packages/server/src/enterprise/controllers/organization.controller.ts
public async updateSubscriptionPlan(req: Request, res: Response, next: NextFunction) {
const { subscriptionId, newPlanId, prorationDate } = req.body
const identityManager = getRunningExpressApp().identityManager
const result = await identityManager.updateSubscriptionPlan(
req,
subscriptionId,
newPlanId,
prorationDate
)
return res.status(StatusCodes.OK).json(result)
}
The server trusts the user-supplied subscriptionId and forwards it to the Stripe integration layer.
Missing validation: subscriptionId belongs to req.user.activeOrganization
updateAdditionalSeats
public async updateAdditionalSeats(req: Request, res: Response, next: NextFunction) {
const { subscriptionId, quantity, prorationDate } = req.body
const identityManager = getRunningExpressApp().identityManager
const result = await identityManager.updateAdditionalSeats(
subscriptionId,
quantity,
prorationDate
)
return res.status(StatusCodes.OK).json(result)
}
Again, the subscriptionId is taken directly from the request body without verifying ownership.
PoC
Step 1 - Obtain victim subscriptionId
This identifier may be obtained via the organization read endpoint or other exposed references.
Example:
sub_YYYYYYYYYYYY
Step 2 - Modify victim subscription
POST /api/v1/organization/update-subscription-plan
Host: target.example.com
Cookie: token=<attacker-session>
Content-Type: application/json
{
"subscriptionId": "sub_YYYYYYYYYYYY",
"newPlanId": "free_plan_id",
"prorationDate": 1735689600
}
Step 3 - Change seat quantity
POST /api/v1/organization/update-additional-seats
Host: target.example.com
Cookie: token=<attacker-session>
Content-Type: application/json
{
"subscriptionId": "sub_YYYYYYYYYYYY",
"quantity": 0,
"prorationDate": 1735689600
}
Impact
An authenticated attacker can manipulate the Stripe subscription of other organizations.
Possible consequences include:
- Unauthorized subscription upgrades to higher-priced plans
- Manipulation of paid seat quantities leading to unintended charges
- Service disruption through plan downgrades
Because the vulnerability allows cross-tenant manipulation of billing resources, it represents a high-impact authorization flaw.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.1.2"
},
"package": {
"ecosystem": "npm",
"name": "flowise"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-70476"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-04T19:24:07Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\nSeveral organization billing endpoints accept attacker-controlled Stripe identifiers (subscriptionId) without verifying that the identifier belongs to the authenticated user\u0027s organization. This allows an authenticated attacker to perform unauthorized Stripe subscription operations on other tenants. As a result, an authenticated user can manipulate the Stripe subscription of another organization by supplying a victim organization\u0027s subscriptionId.\n\nThis allows attackers to perform unauthorized billing operations such as changing subscription plans or modifying seat quantities, resulting in potential financial impact and service disruption.\n\n\n### Details\nMultiple organization billing endpoints accept subscriptionId directly from user input without validating ownership. The server relies on a client-supplied Stripe subscription identifier rather than resolving the subscription from the authenticated user\u0027s organization context.\n\n**File**\n\npackages/server/src/enterprise/routes/organization.route.ts\n\nAffected routes:\n\n```typescript\nrouter.post(\u0027/update-additional-seats\u0027, organizationController.updateAdditionalSeats)\nrouter.post(\u0027/update-subscription-plan\u0027, organizationController.updateSubscriptionPlan)\nupdateSubscriptionPlan\n```\n\n**File**\n\npackages/server/src/enterprise/controllers/organization.controller.ts\n\n```typescript\npublic async updateSubscriptionPlan(req: Request, res: Response, next: NextFunction) {\n const { subscriptionId, newPlanId, prorationDate } = req.body\n\n const identityManager = getRunningExpressApp().identityManager\n\n const result = await identityManager.updateSubscriptionPlan(\n req,\n subscriptionId,\n newPlanId,\n prorationDate\n )\n\n return res.status(StatusCodes.OK).json(result)\n}\n```\n\nThe server trusts the user-supplied subscriptionId and forwards it to the Stripe integration layer.\n\nMissing validation:\nsubscriptionId belongs to req.user.activeOrganization\n\nupdateAdditionalSeats\n\n```typescript\npublic async updateAdditionalSeats(req: Request, res: Response, next: NextFunction) {\n const { subscriptionId, quantity, prorationDate } = req.body\n\n const identityManager = getRunningExpressApp().identityManager\n\n const result = await identityManager.updateAdditionalSeats(\n subscriptionId,\n quantity,\n prorationDate\n )\n\n return res.status(StatusCodes.OK).json(result)\n}\n```\n\nAgain, the subscriptionId is taken directly from the request body without verifying ownership.\n\n### PoC\nStep 1 - Obtain victim subscriptionId\n\nThis identifier may be obtained via the organization read endpoint or other exposed references.\n\nExample:\n\nsub_YYYYYYYYYYYY\n\nStep 2 - Modify victim subscription\n\n```http\nPOST /api/v1/organization/update-subscription-plan\nHost: target.example.com\nCookie: token=\u003cattacker-session\u003e\nContent-Type: application/json\n\n{\n \"subscriptionId\": \"sub_YYYYYYYYYYYY\",\n \"newPlanId\": \"free_plan_id\",\n \"prorationDate\": 1735689600\n}\n```\n\nStep 3 - Change seat quantity\n\n```http\nPOST /api/v1/organization/update-additional-seats\nHost: target.example.com\nCookie: token=\u003cattacker-session\u003e\nContent-Type: application/json\n\n{\n \"subscriptionId\": \"sub_YYYYYYYYYYYY\",\n \"quantity\": 0,\n \"prorationDate\": 1735689600\n}\n```\n\n### Impact\nAn authenticated attacker can manipulate the Stripe subscription of other organizations.\n\nPossible consequences include:\n\n- Unauthorized subscription upgrades to higher-priced plans\n- Manipulation of paid seat quantities leading to unintended charges\n- Service disruption through plan downgrades\n\nBecause the vulnerability allows cross-tenant manipulation of billing resources, it represents a high-impact authorization flaw.",
"id": "GHSA-gmmw-qg98-6j6p",
"modified": "2026-08-04T19:24:07Z",
"published": "2026-08-04T19:24:07Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-gmmw-qg98-6j6p"
},
{
"type": "WEB",
"url": "https://github.com/FlowiseAI/Flowise/pull/6321"
},
{
"type": "WEB",
"url": "https://github.com/FlowiseAI/Flowise/commit/4d7899d02ca370a5510406be5c91483085a412f9"
},
{
"type": "PACKAGE",
"url": "https://github.com/FlowiseAI/Flowise"
},
{
"type": "WEB",
"url": "https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation"
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.