What’s Vulnerable › Vulnerabilities

CVE-2025-71328: Flowise - Unverified Password Change via Account Settings

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-06-25 · updated 2026-10-12
• Weakness: CWE-620

Description

Flowise before 3.0.10 contains an unverified password change vulnerability. An authenticated user can change their account password through the account settings (Security) section without supplying the current password or any additional verification, as the application does not enforce a current-password check on the credential change. This can lead to full account takeover, particularly if an attacker can hijack or coerce an authenticated session.

Affected products

• FlowiseAI Flowise: before 3.0.10 — fixed in 3.0.10

How to fix

Upgrade to a fixed version: FlowiseAI Flowise 3.0.10. Check the vendor advisory for mitigations.

References

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-fjh6-8679-9pch
• https://www.vulncheck.com/advisories/flowise-unverified-password-change-via-account-settings
• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-fjh6-8679-9pch

Get alerted when CVE-2025-71328 or the next vulnerability affects your stack