PT-2026-52611

CVE-2025-71328

Published

2025-11-14

Updated

2026-10-12

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.0.10

Description An authenticated user can change their account password through the account settings (Security) section without providing the current password or any additional verification. This occurs because the application fails to enforce a current-password check during the credential change process, which could lead to full account takeover if an authenticated session is hijacked or coerced.

Recommendations Update to version 3.0.10 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-306: Missing Authentication for Critical Function

CWE-620: Unverified Password Change

Related identifiers