CVE-2025-71328

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.0.10

Description An authenticated user can change their account password through the account settings (Security) section without providing the current password or any additional verification. This occurs because the application fails to enforce a current-password check during the credential change process, which could lead to full account takeover if an authenticated session is hijacked or coerced.

Recommendations Update to version 3.0.10 or later.