EUVD-2026-38119
GHSA-qr8q-6c25-rppr
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible API requires a pre-obtained authenticated session (PR:L, AC:H); integrity impact is high via password hash overwrite; no confidentiality or availability impact applies.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Flowise before 3.1.2 contains a mass assignment vulnerability in the PUT /api/v1/user endpoint that allows authenticated users to directly modify the credential field without validation. Attackers can bypass password change verification and session invalidation by supplying a crafted password hash, establishing persistent account access after temporary session compromise.
AnalysisAI
Mass assignment in Flowise's PUT /api/v1/user endpoint (all versions before 3.1.2) allows an authenticated user to overwrite their own account's password hash by supplying a crafted credential field in the request body, entirely bypassing the intended old-password verification, hashing enforcement, and session-invalidation workflow. An attacker who first obtains a temporary session - via XSS, token theft, or session hijacking - can exploit this to establish permanent account persistence even after the legitimate session expires, with no knowledge of the current password required. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 3.1.2.
Technical ContextAI
Flowise is an open-source low-code AI chatbot builder distributed as an npm package (flowise). The vulnerable endpoint is PUT /api/v1/user in the Node.js/TypeScript backend. The root cause is CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes - Mass Assignment): the controller forwards the raw req.body object directly to userService.updateUser() without applying a field allowlist. The service layer then passes this unfiltered input to TypeORM's queryRunner.manager.merge(User, oldUserData, newUserData), which applies every field present in newUserData - derived from req.body - onto the persisted User entity. This exposes sensitive entity fields beyond the intended name/email profile fields, including credential (the stored password hash), tempToken, tokenExpiry, and status. While an ID check in the controller prevents modification of other users' records (blocking IDOR), the merge operation's lack of field filtering is the direct root cause. Affected CPE: cpe:2.3:a:flowise:flowise:*:*:*:*:*:*:*:* covering npm versions <= 3.1.1.
RemediationAI
Upgrade Flowise to version 3.1.2 or later (vendor-released patch: 3.1.2), which resolves the mass assignment flaw by introducing field filtering in the PUT /api/v1/user endpoint to block direct modification of sensitive entity fields such as credential. The fix is documented in the GitHub Security Advisory GHSA-59fh-9f3p-7m39 at https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-59fh-9f3p-7m39. If immediate patching is not feasible, restrict network access to the PUT /api/v1/user endpoint via a reverse-proxy WAF rule or network ACL for untrusted authenticated users - note this will break legitimate profile-update functionality as a trade-off. Additionally, reducing session token lifetimes and hardening against XSS in the Flowise UI will shrink the attacker's window to acquire the prerequisite session, since AC:H exploitation depends entirely on that prior session compromise. Administrators of affected instances should audit application logs for unexpected PUT /api/v1/user requests containing a credential field, which would indicate attempted or successful exploitation.
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Flowise versions before 3.0.1 allow unauthenticated access to the Custom MCPs feature, which is designed to execute OS c
FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. Una
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Flowise is a drag & drop user interface to build a customized large language model flow. Rated critical severity (CVSS 9
Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthent
Missing authentication on NVD data endpoint in Flowise before 3.0.13 allows unauthenticated access to internal vulnerabi
Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDat
Arbitrary file read and write in FlowiseAI Flowise (versions 2.2.8 through 3.0.5) lets remote unauthenticated attackers
Authenticated remote code execution in FlowiseAI Flowise prior to 3.1.2 allows any user with a valid session or API key
Privilege escalation in Flowise versions prior to 3.0.13 allows authenticated users to bypass API authorization by spoof
Flowise versions up to 3.0.13 is affected by authorization bypass through user-controlled key (CVSS 8.8).
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today