Description
Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email change vulnerability. An authenticated user can change the account email address, used as a login identifier and password-recovery channel, via the account profile endpoint without confirming the change to the original email address or re-entering the current password. By changing the recovery email, an attacker can take over the account and abuse password reset mechanisms.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Flowise | Flowise | < 3.0.10 | 3.0.10 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | flowise-ui | < 3.0.10 | 3.0.10 | GHSA-x39m-3393-3qp4 |
Advisories 1
- WID-SEC-2025-2591 Flowise: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Jun 23, 2026
References
- GitHub Security Advisory (GHSA-x39m-3393-3qp4) vendor-advisory
- VulnCheck Advisory: Flowise - Unverified Email Change via Account Profile Endpoint third-party-advisory