CVE-2025-71337

Summary

Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email change vulnerability. An authenticated user can change the account email address, used as a login identifier and password-recovery channel, via the account profile endpoint without confirming the change to the original email address or re-entering the current password. By changing the recovery email, an attacker can take over the account and abuse password reset mechanisms.

Affected Software

Weaknesses

• CWE-620: Unverified Password Change

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: total

Additional References

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x39m-3393-3qp4

References

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x39m-3393-3qp4
• https://www.vulncheck.com/advisories/flowise-unverified-email-change-via-account-profile-endpoint

• ←Previous
• Next→