PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-71337 Flowise CVE debrief

CVE-2025-71337 is a HIGH-severity vulnerability in Flowise, a product by Flowiseai, affecting versions 3.0.7 and earlier. An authenticated user can change the account email address via the account profile endpoint without confirming the change to the original email address or re-entering the current password. This allows an attacker to take over the account and abuse password reset mechanisms. The vulnerability has a CVSS score of 8.7. Flowiseai has released a patch in version 3.0.10. Users should update to the latest version to mitigate this risk.

Vendor
Flowise
Product
Unknown
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-23
Original CVE updated
2026-06-25
Advisory published
2026-06-23
Advisory updated
2026-06-25

Who should care

Security teams and administrators responsible for Flowise installations should prioritize patching this vulnerability. Given the HIGH severity and potential for account takeover, defenders should treat affected systems as high-risk and verify that the patch has been applied. Additionally, defenders may want to monitor for suspicious account activity.

Technical summary

The vulnerability exists in the account profile endpoint of Flowise, allowing an authenticated user to change the email address associated with their account without proper verification. This can be exploited by an attacker to gain control of the account. The issue is resolved in Flowise version 3.0.10. The CVSS vector for this vulnerability is CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

Patch Flowise to version 3.0.10 or later immediately. Verify that all affected systems have been updated and monitor for suspicious account activity.

Recommended defensive actions

  • Patch Flowise to version 3.0.10 or later
  • Verify that all affected systems have been updated
  • Monitor for suspicious account activity
  • Restrict access to the account profile endpoint
  • Implement additional authentication mechanisms for email changes

Evidence notes

The CVE-2025-71337 vulnerability details were obtained from the NVD and CVE.org. The vulnerability affects Flowise versions 3.0.7 and earlier. The CVSS score is 8.7, indicating a HIGH severity vulnerability. A patch is available in Flowise version 3.0.10.

Official resources

This article is AI-assisted and based on the supplied source corpus.