Flowise: Flowise before 3.0.10 contains an unverified password change vulnerability
Flowise
More for Flowise RSS feed for Flowise
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2025-71328
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 25, 2026
- Source last modified
- October 12, 2026
Description
Flowise before 3.0.10 contains an unverified password change vulnerability. An authenticated user can change their account password through the account settings (Security) section without supplying the current password or any additional verification, as the application does not enforce a current-password check on the credential change. This can lead to full account takeover, particularly if an attacker can hijack or coerce an authenticated session.
Description quoted from the NVD record.
Who is affected
Flowise is a tool for building apps that use AI language models. This flaw affects versions before 3.0.10. In the Security section of the account settings, a signed-in user can change their account password without entering the current password or passing any other check. If an attacker can take over or misuse a signed-in session, they could change the password and take full control of the account. This flaw is rated High.
What to do
- The person who installed or runs Flowise for your organization should act on this flaw, or the IT provider or vendor who manages it for you.
- Update Flowise to version 3.0.10, which is the fixed version for this flaw.
- If an IT provider or vendor manages Flowise for you, send them this advisory and ask when the update will be done.
- Check the vendor advisory linked on this page for any further details about this flaw.
Analysis written from the source record as of October 12, 2026 and reviewed before publishing.