What’s Vulnerable › Vulnerabilities

CVE-2026-56276: Flowise - Mass Assignment in PUT /api/v1/user Allows Password Hash Override

• Severity: medium (CVSS 6.0 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-20 · updated 2026-06-22
• Weakness: CWE-915

Description

Flowise before 3.1.2 contains a mass assignment vulnerability in the PUT /api/v1/user endpoint that allows authenticated users to directly modify the credential field without validation. Attackers can bypass password change verification and session invalidation by supplying a crafted password hash, establishing persistent account access after temporary session compromise.

Affected products

• FlowiseAI Flowise: before 3.1.2 — fixed in 3.1.2

How to fix

Upgrade to a fixed version: FlowiseAI Flowise 3.1.2. Check the vendor advisory for mitigations.

References

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-59fh-9f3p-7m39
• https://www.vulncheck.com/advisories/flowise-mass-assignment-in-put-api-v1-user-allows-password-hash-override
• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-59fh-9f3p-7m39

Get alerted when CVE-2026-56276 or the next vulnerability affects your stack