VULNERABILITY INTELLIGENCE

CVE-2025-71337

CVSS score8.3 HIGH
EPSS probability0.42%
CISA KEVNot currently listed
Published2026-06-23
Last modified2026-10-12
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Description

Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email change vulnerability. An authenticated user can change the account email address, used as a login identifier and password-recovery channel, via the account profile endpoint without confirming the change to the original email address or re-entering the current password. By changing the recovery email, an attacker can take over the account and abuse password reset mechanisms.

Weakness classification

  • disclosure@vulncheck.com: CWE-620

Primary references