CVE-2025-71328

Katalog CVE

CVSS 8.8 · High EPSS 0,47%

Kerentanan Unverified Password Change pada flowiseai flowise. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Flowise before 3.0.10 contains an unverified password change vulnerability. An authenticated user can change their account password through the account settings (Security) section without supplying the current password or any additional verification, as the application does not enforce a current-password check on the credential change. This can lead to full account takeover, particularly if an attacker can hijack or coerce an authenticated session.

Rincian

Terbit di NVD

25 Juni 2026

Terakhir diubah

12 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-620: Unverified Password Change

EPSS (30 hari)

0,47% peluang dieksploitasi; lebih tinggi dari 39,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-fjh6-8679-9pch exploit · advisory vendor
• https://www.vulncheck.com/advisories/flowise-unverified-password-change-via-account-settings advisory pihak ketiga