●PocketClawAI security alerts
Sign in
mediumCVSS 6.9NVD status: Deferred

CVE-2026-56267

Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoint that returns full user objects including PII to unauthenticated attackers.

ComponentFlowise
Severitymedium (CVSS 6.9)
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published (NVD)2026-06-20
Last modified2026-06-22
Affected versions
< 3.0.13
read from the advisory text: NVD has not published CPE data yet
Fixed in3.0.13
WeaknessCWE-200
CISA KEVnot listed

NVD description

Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoint that returns full user objects including PII to unauthenticated attackers. An attacker can enumerate valid email addresses and harvest sensitive user data including user IDs, names, account status, and timestamps by sending requests with known email addresses.

Does CVE-2026-56267 hit the version you run?Paste your docker-compose.yml, requirements.txt or package.json. The scanner checks your pinned versions against this CVE and every other one we track for Flowise.
Check my stack

What to do

  • Upgrade Flowise to 3.0.13 or later.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources

Other Flowise CVEs

high
CVE-2026-100610CVSS 7.5

Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the...

Flowise
2026-09-26high
CVE-2026-100608CVSS 8.3

Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. When the server runs in queue mode with the dashboard en...

Flowise
2026-09-26high
CVE-2026-100605CVSS 7.1

Flowise through 3.1.4 contains missing route-level RBAC checks on chat message endpoints that allow low-privileged API keys to read and dele...

Flowise
2026-09-26medium
CVE-2026-100609CVSS 6.8

Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up credentials by ID without filtering on the requesting user'...

Flowise
2026-09-26high
CVE-2026-100607CVSS 7.7

Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowin...

Flowise
2026-09-26high
CVE-2026-100606CVSS 7.7

Flowise through 3.1.4 (Enterprise/platform mode with SSO enabled) contains an authentication bypass in the SSO login path. When an SSO callb...

Flowise
2026-09-26

All Flowise CVEs