CVE-2025-71337
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk21th percentile — higher than 21% of all known CVEs
Summary
Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email change vulnerability. An authenticated user can change the account email address without confirming the change to the original email address or re-entering the current password.
Risk Assessment
Changing the recovery email by an attacker can lead to account takeover and abuse of password reset mechanisms, posing a serious security threat to user accounts.
Recommendation
It is recommended to upgrade to Flowise version 3.0.10 or later to mitigate this vulnerability. Additionally, implementing extra verification mechanisms when changing the email address is advisable.
Original NVD description (English source)
Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email change vulnerability. An authenticated user can change the account email address, used as a login identifier and password-recovery channel, via the account profile endpoint without confirming the change to the original email address or re-entering the current password. By changing the recovery email, an attacker can take over the account and abuse password reset mechanisms.