CVE-2026-8028

Katalog CVE

CVSS 3.7 · Low EPSS 0,53%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada flowiseai flowise. Skor CVSS 3.1 3.7 (Low) menurut vuldb.com.

Deskripsi (NVD)

A vulnerability was detected in FlowiseAI Flowise up to 3.0.12. This affects the function verify of the file packages/server/src/enterprise/services/account.service.ts of the component Endpoint. Performing a manipulation results in information disclosure. Remote exploitation of the attack is possible. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit is now public and may be used. Upgrading the affected component is recommended.

Rincian

Terbit di NVD

6 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

3.7 (Low), sumber vuldb.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-284: Improper Access Control

EPSS (30 hari)

0,53% peluang dieksploitasi; lebih tinggi dari 43,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/YLChen-007/1d52497b0221835f99367be61612746b exploit · advisory pihak ketiga
• https://vuldb.com/submit/777659 advisory pihak ketiga · vdb entry
• https://vuldb.com/vuln/361276 advisory pihak ketiga · vdb entry
• https://vuldb.com/vuln/361276/cti permissions required · vdb entry