CVE-2025-71337: Flowise - Unverified Email Change via Account Profile Endpoint

Severity: high (CVSS 8.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-06-23 · updated 2026-10-12
Weakness: CWE-620

Description

Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email change vulnerability. An authenticated user can change the account email address, used as a login identifier and password-recovery channel, via the account profile endpoint without confirming the change to the original email address or re-entering the current password. By changing the recovery email, an attacker can take over the account and abuse password reset mechanisms.

Affected products

FlowiseAI Flowise: through 3.0.7

References

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x39m-3393-3qp4
https://www.vulncheck.com/advisories/flowise-unverified-email-change-via-account-profile-endpoint
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x39m-3393-3qp4

Get alerted when CVE-2025-71337 or the next vulnerability affects your stack