PT-2026-51150

CVE-2026-56267

Published

2026-03-05

Updated

2026-06-20

Description by

CVSS 4.0

6.9

Medium

MetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.0.13

Description An information exposure issue exists in the 'POST /api/v1/account/forgot-password' endpoint. Unauthenticated attackers can enumerate valid email addresses and harvest sensitive user data, including PII (Personally Identifiable Information), user IDs, names, account status, and timestamps, by sending requests with known email addresses. This occurs because the endpoint returns full user objects.

Recommendations Update to version 3.0.13 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Tenbbughunters

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Related identifiers