●PocketClawAI security alerts
Sign in
mediumCVSS 6NVD status: Deferred

CVE-2026-56276

Flowise before 3.1.2 contains a mass assignment vulnerability in the PUT /api/v1/user endpoint that allows authenticated users to directly modify the credential field without validation.

ComponentFlowise
Severitymedium (CVSS 6)
CVSS vectorCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published (NVD)2026-06-20
Last modified2026-06-22
Affected versions
< 3.1.2
read from the advisory text: NVD has not published CPE data yet
Fixed in3.1.2
WeaknessCWE-915
CISA KEVnot listed

NVD description

Flowise before 3.1.2 contains a mass assignment vulnerability in the PUT /api/v1/user endpoint that allows authenticated users to directly modify the credential field without validation. Attackers can bypass password change verification and session invalidation by supplying a crafted password hash, establishing persistent account access after temporary session compromise.

Does CVE-2026-56276 hit the version you run?Paste your docker-compose.yml, requirements.txt or package.json. The scanner checks your pinned versions against this CVE and every other one we track for Flowise.
Check my stack

What to do

  • Upgrade Flowise to 3.1.2 or later.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources

Other Flowise CVEs

high
CVE-2026-100610CVSS 7.5

Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the...

Flowise
2026-09-26high
CVE-2026-100608CVSS 8.3

Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. When the server runs in queue mode with the dashboard en...

Flowise
2026-09-26high
CVE-2026-100605CVSS 7.1

Flowise through 3.1.4 contains missing route-level RBAC checks on chat message endpoints that allow low-privileged API keys to read and dele...

Flowise
2026-09-26medium
CVE-2026-100609CVSS 6.8

Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up credentials by ID without filtering on the requesting user'...

Flowise
2026-09-26high
CVE-2026-100607CVSS 7.7

Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowin...

Flowise
2026-09-26high
CVE-2026-100606CVSS 7.7

Flowise through 3.1.4 (Enterprise/platform mode with SSO enabled) contains an authentication bypass in the SSO login path. When an SSO callb...

Flowise
2026-09-26

All Flowise CVEs