Description (CNA)
Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email change vulnerability. An authenticated user can change the account email address, used as a login identifier and password-recovery channel, via the account profile endpoint without confirming the change to the original email address or re-entering the current password. By changing the recovery email, an attacker can take over the account and abuse password reset mechanisms.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Flowise / Flowise | affected 0 before 3.0.10; unaffected 3.0.10 |
CWE
CWE-620
References
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x39m-3393-3qp4
- https://www.vulncheck.com/advisories/flowise-unverified-email-change-via-account-profile-endpoint
ADP enrichment
No English description supplied.