Executive brief
Flowise, an open-source tool for building LLM applications, contains a security flaw in its account management settings. An authenticated user can change their account password without being asked for their current password. This allows an attacker who has gained temporary access to a user's session to permanently take over the account by changing the credentials.
Technical details
Flowise versions prior to 3.0.10 suffer from an unverified password change vulnerability (CWE-620). The application's 'Security' settings section fails to enforce a current-password check when a user updates their credentials. An attacker with low-privileged network access—specifically one who has hijacked an active session or is operating within an authenticated context—can change the account password without knowing the original. This leads to complete account takeover and potential persistence. The issue is addressed in version 3.0.10.
Affected products
- FlowiseAI Flowise < 3.0.10
Timeline
- 2025-11-12: advisory: Initial GitHub Security Advisory published
- 2026-06-25: disclosed: CVE published and NVD record created