CVE-2025-71328
Flowise - Unverified Password Change via Account Settings
CVSS Score
8.3
EPSS Score
0.0%
EPSS Percentile
0th
Flowise before 3.0.10 contains an unverified password change vulnerability. An authenticated user can change their account password through the account settings (Security) section without supplying the current password or any additional verification, as the application does not enforce a current-password check on the credential change. This can lead to full account takeover, particularly if an attacker can hijack or coerce an authenticated session.
| CWE | CWE-620 |
| Vendor | flowise |
| Product | flowise |
| Published | Jun 25, 2026 |
Stay Ahead of the Next One
Get instant alerts for flowise flowise
Be the first to know when new high vulnerabilities affecting flowise flowise are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low
Affected Versions
Flowise / Flowise
0 < 3.0.10
References
Credits
🔍 mbiesiad