Vulnerability · Published Jun 25, 2026 · Assigned by VulnCheck

CVE-2025-71328Flowise - Unverified Password Change via Account Settings

High 8.3

In plain English

A high-severity security flaw in Flowise from Flowise. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.3High

Exploit odds (30 days)0.5%top 59.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Flowise before 3.0.10 contains an unverified password change vulnerability. An authenticated user can change their account password through the account settings (Security) section without supplying the current password or any additional verification, as the application does not enforce a current-password check on the credential change. This can lead to full account takeover, particularly if an attacker can hijack or coerce an authenticated session.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	flowise-ui	3.0.10	GHSA-fjh6-8679-9pch

Affected products (as reported)

Vendor	Product	Versions
Flowise	Flowise	0 – before 3.0.10

Weakness: CWE-620 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

References

GitHub Security Advisory (GHSA-fjh6-8679-9pch) vendor-advisory
VulnCheck Advisory: Flowise - Unverified Password Change via Account Settings third-party-advisory