Description
Flowise before 3.1.2 contains a mass assignment vulnerability in the PUT /api/v1/user endpoint that allows authenticated users to directly modify the credential field without validation. Attackers can bypass password change verification and session invalidation by supplying a crafted password hash, establishing persistent account access after temporary session compromise.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Flowise | Flowise | < 3.1.2 | 3.1.2 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | flowise | < 3.1.2 | 3.1.2 | GHSA-59fh-9f3p-7m39 |
Advisories 1
- WID-SEC-2026-0626 Flowise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 21, 2026
References
- GitHub Security Advisory (GHSA-59fh-9f3p-7m39) vendor-advisory
- VulnCheck Advisory: Flowise - Mass Assignment in PUT /api/v1/user Allows Password Hash Override third-party-advisory