CVE-2026-56276: Flowise - Mass Assignment in PUT /api/v1/user Allows Password Hash Override
Flowise before 3.1.2 contains a mass assignment vulnerability in the PUT /api/v1/user endpoint that allows authenticated users to directly modify the credential field without validation. Attackers can bypass password change verification and session invalidation by supplying a crafted password hash, establishing persistent account access after temporary session compromise.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56276?
CVE-2026-56276 has a risk score of 55, indicating a moderate severity level.
How do I fix CVE-2026-56276?
To mitigate CVE-2026-56276, update Flowise to version 3.1.2 or later, which addresses the mass assignment vulnerability.
Who is affected by CVE-2026-56276?
Authenticated users of Flowise versions prior to 3.1.2 are vulnerable to CVE-2026-56276.
What type of vulnerability is CVE-2026-56276?
CVE-2026-56276 is a mass assignment vulnerability allowing unauthorized manipulation of user credentials.
What could an attacker do with CVE-2026-56276?
An attacker exploiting CVE-2026-56276 could override password hashes, bypass verification processes, and maintain unauthorized access.