Vulnerability · Published Jun 20, 2026 · Assigned by VulnCheck

CVE-2026-56267Flowise - PII Disclosure via Unauthenticated Forgot Password Endpoint

Medium 6.9

In plain English

A medium-severity information exposure in Flowise from Flowise. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.5%top 59.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoint that returns full user objects including PII to unauthenticated attackers. An attacker can enumerate valid email addresses and harvest sensitive user data including user IDs, names, account status, and timestamps by sending requests with known email addresses.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	flowise	3.0.13	GHSA-jc5m-wrp2-qq38

Affected products (as reported)

Vendor	Product	Versions
Flowise	Flowise	0 – before 3.0.13

Weakness: CWE-200 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N

References

GHSA Advisory GHSA-jc5m-wrp2-qq38 vendor-advisory
VulnCheck Advisory: Flowise - PII Disclosure via Unauthenticated Forgot Password Endpoint third-party-advisory