🛡️ CVE-2025-71337 — flowise

🟠 CVSS 8.3 — High ⚠️ Exploit Public CWE-620 NVD
8.3
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

Flowise doesn't Prevent Bypass of Password Confirmation through Unverified Email Change (credentials)

Summary

Unverified Email Change - Email as part of Credential / Unverified Account Recovery Channel Change

The application allows changing the account email address (used as a login identifier and/or password recovery address) without verifying the requester’s authority to make that change (no confirmation to the old email, no authentication step). Because email often functions as a credential or recovery channel, unverified email changes enable attackers to take over accounts by switching the account’s recovery/login address.

Details

Occurence - code:

https://github.com/FlowiseAI/Flowise/blob/main/packages/ui/src/views/account/index.jsx#L211

Remote and physical scenarios can be considered.

PoC

Repro steps:

1. As logged in user https://cloud.flowiseai.com/account scroll down to 'Profile' section

2. Change email to the new email

3. Notice Unverified Password Change (authenticated change without current password)

Later this email is needed as credentials to log in or reset password feature.

POC:

Email changed, and notice "Profile updated" message.

Screenshot

<img width="329" height="357" alt="secbug" src="https://github.com/user-attachments/assets/d3c77835-35bb-47dc-8cd2-83e4e266e5a4" />

Impact

Full account takeover (ATO) of affected accounts (loss of confidentiality and integrity of account data).

User account recovery mechanisms (password reset flows tied to email) can be bypassed or abused if combined with this issue and the second one which I've reported (similar security issue with the password - part of credentials). (gain persistence)

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is low, an attacker needs low-level privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality high, integrity high, availability low.

Weakness class

CVE-2025-71337 is classified as CWE-620: Unverified Password Change. A password can be changed without confirming the current one or the identity of the requester.

Affected software

CVE-2025-71337 is recorded against 2 packages.

  • flowise (fixed in 3.0.7)
  • flowise-ui

Timeline and source

Published on 23 June 2026 and last revised on 25 June 2026. A public exploit is known to exist, which raises the urgency of patching considerably. Record sourced from NVD.

References

github.com
www.vulncheck.com
github.com

Details

Severity HIGH
CVSS Score 8.3
CVSS Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
CWE CWE-620
Public Exploit ⚠️ Yes
Source NVD
Published 2026-06-23
Updated 2026-08-12
Modified 2026-06-25
Fix URL N/A

Affected Packages

Software From version Fixed in
flowise — 3.0.7
flowise-ui — —

Similar Threats

Exploit Protection

Are you running flowise?

CVE-2025-71337 carries CVSS 8.3 High rating and a public exploit already exists. BotEraser checks your installation against this and other known CVE records, and blocks IPs associated with exploit activity.

Check My Site For CVE-2025-71337 →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.