CVE-2025-71327

Katalog CVE

CVSS 9.1 · Critical EPSS 0,68%

Kerentanan Missing Authentication for Critical Function pada flowiseai flowise. Skor CVSS 3.1 9.1 (Critical) menurut vulncheck.com.

Deskripsi (NVD)

Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register endpoint that allows unauthenticated attackers to create user accounts. Remote attackers can exploit this endpoint to register arbitrary accounts and authenticate to the system, gaining full API access without credentials.

Rincian

Terbit di NVD

25 Juni 2026

Terakhir diubah

12 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

0,68% peluang dieksploitasi; lebih tinggi dari 50,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-v5w9-prxf-w882 exploit · advisory vendor
• https://www.vulncheck.com/advisories/flowise-authentication-bypass-via-unprotected-registration-endpoint advisory pihak ketiga