Flowise: Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email change…
Flowise
More for Flowise RSS feed for Flowise
- Severity
- High, CVSS 8.3
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
- Record
- CVE-2025-71337
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 23, 2026
- Source last modified
- October 12, 2026
Description
Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email change vulnerability. An authenticated user can change the account email address, used as a login identifier and password-recovery channel, via the account profile endpoint without confirming the change to the original email address or re-entering the current password. By changing the recovery email, an attacker can take over the account and abuse password reset mechanisms.
Description quoted from the NVD record.
Who is affected
Flowise, a tool for building apps that use AI language models, has a flaw in its account profile settings. This flaw affects Flowise before 3.0.10, with versions 3.0.7 and earlier named as affected. Someone who is signed in to an account can change its email address, which is used to log in and to recover a lost password, without confirming the change through the original email address or entering the current password. By changing that recovery email, an attacker can take over the account and misuse password resets. This flaw is rated High.
What to do
- Find out who looks after Flowise for your organization: the person who installed or runs it, or the IT provider or vendor who manages it for you.
- If someone in your organization runs Flowise, that person should update it to version
3.0.10or later as soon as possible, since that version fixes this flaw. - If an IT provider or vendor runs Flowise for your organization, send them this advisory and ask when the update to version
3.0.10will be done.
Analysis written from the source record as of October 12, 2026 and reviewed before publishing.