Description
Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoint that returns full user objects including PII to unauthenticated attackers. An attacker can enumerate valid email addresses and harvest sensitive user data including user IDs, names, account status, and timestamps by sending requests with known email addresses.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Flowise | Flowise | < 3.0.13 | 3.0.13 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | flowise | < 3.0.13 | 3.0.13 | GHSA-jc5m-wrp2-qq38 |
Advisories 1
- WID-SEC-2026-0626 Flowise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 21, 2026
References
- GitHub Security Advisory (GHSA-jc5m-wrp2-qq38) vendor-advisory
- VulnCheck Advisory: Flowise - PII Disclosure via Unauthenticated Forgot Password Endpoint third-party-advisory