EUVD-2025-210304
GHSA-4xff-r326-4qv2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain authenticated Flowise session
-
DeliveryNavigate to /account profile endpoint
-
ExploitSubmit attacker-controlled email without password confirmation
-
ExecutionTrigger password reset to new email
-
PersistSet new password and lock out victim
-
ImpactExfiltrate chatflows, API keys, and credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Password change verification
|
| Exploitation Conditions | Requires a valid authenticated session on a Flowise instance running 3.0.7 or earlier and access to the /account profile endpoint exposing the email field (the default configuration in both self-hosted Flowise and the cloud.flowiseai.com service). No user interaction with the victim is needed, no admin role is required (any authenticated user can change their own account email), and no current-password prompt or email-confirmation challenge gates the change. Exploitation is limited by the attacker first having to obtain that authenticated session (credentials, session hijack, CSRF in a victim browser, or physical access) and by the account being one whose recovery is in fact tied to email login. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L) scores 8.7 and accurately reflects that a low-privilege authenticated user - or anyone who briefly captures a session - can fully take over the account remotely without user interaction. There is no EPSS score, KEV listing, or evidence of active exploitation provided, so this is not a mass-exploitation priority, but the public PoC in the GHSA and the trivial reproduction (a single profile-page interaction) make weaponization effectively free once an attacker has any foothold (session theft, CSRF chain, shared workstation, leaked token). Real-world risk is highest for Flowise Cloud tenants and self-hosted multi-user deployments where accounts hold sensitive API keys, model credentials, and chatflow IP; for single-user local installs the practical impact is far lower. |
| Exploit ScenarioDerived | An attacker obtains a valid Flowise session for a target - for example via a stolen browser cookie, an open laptop, a phishing-driven XSS, or a leaked SSO token - then visits the Profile page and submits a new email address controlled by the attacker, which the server accepts without password re-entry or confirmation to the original mailbox. The attacker then triggers the standard password-reset flow, receives the reset link at the new address, and locks the legitimate user out of the account, gaining persistent access to any chatflows, API keys, and tenant data. A step-by-step PoC with screenshots is published in the GHSA. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 23, 2026
Account takeover in Flowise versions 3.0.7 and earlier allows an authenticated user to change their account email address via the profile endpoint without re-authenticating or confirming the change to the original email. Because email serves as both login identifier and password-recovery channel, an attacker who has hijacked a session (e.g., via XSS, stolen token, or unattended workstation) can pivot to permanent account ownership. Publicly available exploit code exists in the GitHub Security Advisory with reproduction steps, but no public exploit identified as actively used in the wild.
RemediationAI
Vendor-released patch: upgrade flowise-ui (and the Flowise server bundle) to version 3.0.10 or later, which is the fix identified in PR https://github.com/FlowiseAI/Flowise/pull/5294 and tracked in GHSA-x39m-3393-3qp4. If immediate upgrade is not possible, restrict access to the /account profile endpoint at a reverse proxy or WAF (deny PUT/POST to the email field for non-admin users), shorten session lifetimes and enforce re-authentication for sensitive actions, and require operators to monitor audit logs for unexpected email-change events - note this breaks the in-product profile editing UX. Pair the upgrade with a forced password reset for any account whose email was changed during the exposure window, and rotate any API keys or model credentials stored under those accounts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in npm, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Flowise is an open-source low-code platform (npm package flowise-ui) for building LLM orchestration flows and AI agents, exposing a web UI and REST API. The root cause is CWE-620 (Unverified Password Change), applied here to the email-change flow: the account profile endpoint accepts a new email address with only the session cookie as authority, performing neither a re-authentication challenge (current password) nor an out-of-band confirmation to the prior email address. Because the email doubles as the login identifier and the destination for password-reset tokens, it functions as a credential/recovery channel, and changing it silently rewrites both at once.
Know when Flowise gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Network-reachable profile endpoint, low-privilege authenticated user can take over their own account leading to high C/I and limited A; no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email change vulnerability. An authenticated user can change the account email address, used as a login identifier and password-recovery channel, via the account profile endpoint without confirming the change to the original email address or re-entering the current password. By changing the recovery email, an attacker can take over the account and abuse password reset mechanisms.
Executive ViewAI
Flowise versions 3.0.7 and earlier contain a high-severity account takeover vulnerability affecting authenticated users. Attackers who obtain access to a user session can permanently compromise accounts by changing email addresses without confirmation, leveraging email as both the login identifier and password-recovery channel. Publicly available exploit code exists in vendor security advisories.
No vendor-released patch identified at time of analysis. Require confirmation emails for any email-address changes, sent to the current email address before modification takes effect; implement step-up authentication (re-enter password or use MFA) for profile modifications; enforce session timeouts and require re-authentication for sensitive operations; maintain detailed audit logs of all email changes with real-time monitoring and alerting; restrict profile endpoint access via IP allowlist where operationally feasible; deploy WAF rules targeting suspicious profile-modification patterns; enforce multi-factor authentication for all accounts if product supports the feature.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Flowise versions before 3.0.1 allow unauthenticated access to the Custom MCPs feature, which is designed to execute OS c
FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. Una
Arbitrary file read and write in Flowise versions prior to 3.0.8 allows an authenticated attacker with access to the flo
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Flowise is a drag & drop user interface to build a customized large language model flow. Rated critical severity (CVSS 9
Authenticated users can upload arbitrary files to Flowise 3.0.7 due to missing validation, enabling persistent storage o
Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthent
Missing authentication on NVD data endpoint in Flowise before 3.0.13 allows unauthenticated access to internal vulnerabi
Authenticated remote code execution in FlowiseAI Flowise (v3.0.1 up to but not including 3.0.8, and later versions when
Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDat
Remote code execution in FlowiseAI Flowise before 3.1.3 lets an attacker execute arbitrary OS commands as the Flowise pr
Exploit-DB