CVE-2025-71328: Flowise - Unverified Password Change via Account Settings
Flowise before 3.0.10 contains an unverified password change vulnerability. An authenticated user can change their account password through the account settings (Security) section without supplying the current password or any additional verification, as the application does not enforce a current-password check on the credential change. This can lead to full account takeover, particularly if an attacker can hijack or coerce an authenticated session.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71328?
The severity of CVE-2025-71328 is rated high with a score of 8.7.
What does CVE-2025-71328 exploit?
CVE-2025-71328 exploits an unverified password change vulnerability allowing authenticated users to change their password without verification.
How can I mitigate CVE-2025-71328?
To mitigate CVE-2025-71328, upgrade Flowise to version 3.0.10 or later where this vulnerability is addressed.
Who is affected by CVE-2025-71328?
CVE-2025-71328 affects users of Flowise versions prior to 3.0.10.
What actions can an attacker take due to CVE-2025-71328?
An attacker could exploit CVE-2025-71328 to change a user's password without their knowledge, potentially locking them out of their account.