CVE-2025-71328

HIGH

Flowise before 3.0.10 contains an unverified password change vulnerability. An authenticated user can change their account password through the account settings (Security) section without supplying the current password or any additional verification, as the application does not enforce a current-password check on the credential change. This can lead to full account takeover, particularly if an attacker can hijack or coerce an authenticated session.

CVSS v3.1 Score

8.3
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Attack Vector
NETWORK
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
LOW
Published: 6/25/2026Modified: 6/29/2026

Related Intelligence (1)

HIGHVulnerability

NVD HIGH: CVE-2025-71328 — Flowise before 3.0.10 contains an unverified password change vulnerability. An a...

Flowise before 3.0.10 contains an unverified password change vulnerability. An authenticated user can change their account password through the account settings (Security) section without supplying the current password or any additional verification, as the application does not enforce a current-password check on the credential change. This can lead to full account takeover, particularly if an att

CVE-2025-71328
NIST NVD

References (3)

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-fjh6-8679-9pchExploitVendor Advisoryhttps://www.vulncheck.com/advisories/flowise-unverified-password-change-via-account-settingsThird Party Advisoryhttps://github.com/FlowiseAI/Flowise/security/advisories/GHSA-fjh6-8679-9pchExploitVendor Advisory