PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-71327 Flowise CVE debrief

CVE-2025-71327 is a critical authentication bypass vulnerability in Flowise, a software developed by FlowiseAI. The vulnerability exists in the unprotected /api/v1/account/register endpoint, which allows unauthenticated attackers to create arbitrary user accounts and gain full API access without credentials. This vulnerability has a CVSS score of 9.3 and is classified as CRITICAL. The CVE record was published on June 25, 2026, and last modified on June 29, 2026.

Vendor
Flowise
Product
Unknown
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-25
Original CVE updated
2026-06-29
Advisory published
2026-06-25
Advisory updated
2026-06-29

Who should care

Organizations using Flowise should prioritize patching this vulnerability to prevent potential attacks. The vulnerability's critical severity and ease of exploitation make it a high-risk issue. Security teams should review their inventory of Flowise instances and ensure they are updated to a patched version.

Technical summary

The vulnerability is caused by the lack of authentication protection on the /api/v1/account/register endpoint in Flowise. This endpoint allows anyone to create a user account without authentication, potentially leading to unauthorized access to the system. The CVSS vector for this vulnerability is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

This vulnerability has a high defensive priority due to its critical severity and potential for exploitation. Security teams should treat this vulnerability as a high-risk issue and prioritize patching.

Recommended defensive actions

  • Review and update Flowise instances to ensure they are patched against this vulnerability.
  • Verify that the /api/v1/account/register endpoint is properly secured and requires authentication.
  • Monitor Flowise instances for potential exploitation attempts.
  • Implement additional security measures, such as IP restrictions or rate limiting, to reduce the risk of exploitation.
  • Consider compensating controls, such as Web Application Firewalls (WAFs), to detect and prevent exploitation attempts.

Evidence notes

The CVE record and NVD detail provide official information about the vulnerability. The source item URL provides additional metadata about the vulnerability, including references to vendor advisories and third-party advisories.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-71327 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-71327

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-71327 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-71327

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.