CVE Explorer

CVE-2026-56267

Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoint that returns full user objects including PII to unauthenticated attackers. An attacker can enumerate valid email addresses and harvest sensitive user data including user IDs, names, account status, and timestamps by sending requests with known email addresses.

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:41ddb139d2949e8f9362a236c96c6bd27364f6eea0c732dea713c12b5cd3189f

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"defaultStatus":"unaffected","packageURL":"pkg:npm/flowise","product":"Flowise","vendor":"Flowise","versions":[{"lessThan":"3.0.13","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"3.0.13","versionType":"semver"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:edba8a908ff609bf7f93581d0581290a206ea4e23111d31db5fc125d0520df11 · sha256:539d2d57a42e3f6f… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":6.9,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE"},"metric_type":"cvssV4_0"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:edba8a908ff609bf7f93581d0581290a206ea4e23111d31db5fc125d0520df11 · sha256:539d2d57a42e3f6f… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion

{"cweId":"CWE-200","description":"Exposure of Sensitive Information to an Unauthorized Actor","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:edba8a908ff609bf7f93581d0581290a206ea4e23111d31db5fc125d0520df11 · sha256:539d2d57a42e3f6f… · /containers/cna/problemTypes/0/descriptions/0

Source references

3 source assertions

{"tags":["exploit"],"url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-jc5m-wrp2-qq38"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:edba8a908ff609bf7f93581d0581290a206ea4e23111d31db5fc125d0520df11 · sha256:539d2d57a42e3f6f… · /containers/adp/0/references/0

{"name":"GHSA Advisory GHSA-jc5m-wrp2-qq38","tags":["vendor-advisory"],"url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-jc5m-wrp2-qq38"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:edba8a908ff609bf7f93581d0581290a206ea4e23111d31db5fc125d0520df11 · sha256:539d2d57a42e3f6f… · /containers/cna/references/0

{"name":"VulnCheck Advisory: Flowise - PII Disclosure via Unauthenticated Forgot Password Endpoint","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/flowise-pii-disclosure-via-unauthenticated-forgot-password-endpoint"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:edba8a908ff609bf7f93581d0581290a206ea4e23111d31db5fc125d0520df11 · sha256:539d2d57a42e3f6f… · /containers/cna/references/1

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer