EUVD-2026-38118
GHSA-2mv8-gxwc-hq84
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint, no authentication required (PR:N), single-system scope; only partial confidentiality loss (user metadata, not credentials), no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoint that returns full user objects including PII to unauthenticated attackers. An attacker can enumerate valid email addresses and harvest sensitive user data including user IDs, names, account status, and timestamps by sending requests with known email addresses.
AnalysisAI
Unauthenticated PII exposure in Flowise's forgot-password API endpoint allows remote attackers to harvest user objects containing IDs, full names, email addresses, account status, and timestamps by submitting any known or guessed email address. All Flowise releases prior to 3.0.13 are affected via the POST /api/v1/account/forgot-password endpoint, which returns a sanitized but data-rich user object instead of a generic acknowledgment. No public exploit has been identified at time of analysis per CISA KEV, though the GHSA advisory (GHSA-jc5m-wrp2-qq38) includes a working curl-based proof-of-concept demonstrating the full response.
Technical ContextAI
Flowise is an open-source LLM orchestration platform distributed as an npm package (cpe:2.3:a:flowise:flowise:*:*:*:*:*:*:*:*). The vulnerability resides in the enterprise service layer at packages/server/src/enterprise/services/account.service.ts (lines 517-545). The forgotPassword method correctly validates the email and executes password-reset logic, but its return value is a call to sanitizeUser(), which strips authentication-critical fields (credential hash, tempToken, tokenExpiry) yet leaves the rest of the user record intact - including id, name, email, status, createdDate, and updatedDate. The root cause class is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the response channel delivers data to an actor who has not been authorized to receive it. The correct fix is to return a static success message regardless of whether the email matches an account, eliminating both the PII leak and the enumeration oracle.
RemediationAI
Upgrade to Flowise 3.0.13 or later - this is a vendor-released patch confirmed in the npm/flowise package. The fix version is independently confirmed by the GHSA advisory and EUVD-2026-38118. Vendor advisory is at https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-jc5m-wrp2-qq38 and additional analysis is available at https://www.vulncheck.com/advisories/flowise-pii-disclosure-via-unauthenticated-forgot-password-endpoint. If immediate patching is not feasible, a compensating control is to place the POST /api/v1/account/forgot-password endpoint behind a reverse proxy WAF rule that strips or replaces the response body with a static message, though this introduces response-handling complexity and may interfere with legitimate client behavior. Alternatively, network-perimeter access controls restricting the Flowise API to internal or authenticated networks would prevent unauthenticated external access entirely, at the cost of limiting self-service password reset for remote users.
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Flowise versions before 3.0.1 allow unauthenticated access to the Custom MCPs feature, which is designed to execute OS c
FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. Una
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Flowise is a drag & drop user interface to build a customized large language model flow. Rated critical severity (CVSS 9
Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthent
Missing authentication on NVD data endpoint in Flowise before 3.0.13 allows unauthenticated access to internal vulnerabi
Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDat
Remote command execution in Flowise <= 3.1.2 lets an authenticated user break out of the vm2/@flowiseai/nodevm JavaScrip
Arbitrary file read and write in FlowiseAI Flowise (versions 2.2.8 through 3.0.5) lets remote unauthenticated attackers
Authenticated remote code execution in FlowiseAI Flowise prior to 3.1.2 allows any user with a valid session or API key
Remote code execution in Flowise before 3.1.3 lets authenticated users abuse the Custom MCP node - when CUSTOM_MCP_PROTO
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today