What’s Vulnerable › Vulnerabilities

CVE-2026-56267: Flowise - PII Disclosure via Unauthenticated Forgot Password Endpoint

• Severity: medium (CVSS 6.9 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-20 · updated 2026-06-22
• Weakness: CWE-200

Description

Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoint that returns full user objects including PII to unauthenticated attackers. An attacker can enumerate valid email addresses and harvest sensitive user data including user IDs, names, account status, and timestamps by sending requests with known email addresses.

Affected products

• FlowiseAI Flowise: before 3.0.13 — fixed in 3.0.13

How to fix

Upgrade to a fixed version: FlowiseAI Flowise 3.0.13. Check the vendor advisory for mitigations.

References

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-jc5m-wrp2-qq38
• https://www.vulncheck.com/advisories/flowise-pii-disclosure-via-unauthenticated-forgot-password-endpoint
• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-jc5m-wrp2-qq38

Get alerted when CVE-2026-56267 or the next vulnerability affects your stack