Vulnerability · Published May 6, 2026 · Assigned by VulDB

CVE-2026-8026FlowiseAI Flowise API Response account.service.ts login information disclosure

Low 3.7

In plain English

A low-severity information exposure in Flowise from FlowiseAI. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.3%top 82.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in FlowiseAI Flowise up to 3.0.12. Affected is the function Login of the file packages/server/src/enterprise/services/account.service.ts of the component API Response Handler. The manipulation results in information disclosure. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. You should upgrade the affected component.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	flowise	no fix listed	GHSA-8f47-4rh3-x44m

Affected products (as reported)

Vendor	Product	Versions
FlowiseAI	Flowise	3.0.03.0.13.0.23.0.33.0.43.0.53.0.63.0.7

Weakness: CWE-200, CWE-284 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C

References

VDB-361273 | FlowiseAI Flowise API Response account.service.ts login information disclosure vdb-entry, technical-description
VDB-361273 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #777656 | FlowiseAI Flowise <= 3.0.12 Exposure of Sensitive Information (CWE-200) third-party-advisory
https://gist.github.com/YLChen-007/50a553f09aa1c7c04ce18cec13986a91 related