PatchSiren cyber security CVE debrief

CVE-2025-71337 Flowise CVE debrief

CVE-2025-71337 is a HIGH-severity vulnerability in Flowise, a product by Flowiseai, affecting versions 3.0.7 and earlier. An authenticated user can change the account email address via the account profile endpoint without confirming the change to the original email address or re-entering the current password. This allows an attacker to take over the account and abuse password reset mechanisms. The vulnerability has a CVSS score of 8.7. Flowiseai has released a patch in version 3.0.10. Users should update to the latest version to mitigate this risk.

Vendor: Flowise
Product: Unknown
CVSS: HIGH 8.7
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-06-23
Original CVE updated: 2026-06-25
Advisory published: 2026-06-23
Advisory updated: 2026-06-25

Who should care

Security teams and administrators responsible for Flowise installations should prioritize patching this vulnerability. Given the HIGH severity and potential for account takeover, defenders should treat affected systems as high-risk and verify that the patch has been applied. Additionally, defenders may want to monitor for suspicious account activity.

Technical summary

The vulnerability exists in the account profile endpoint of Flowise, allowing an authenticated user to change the email address associated with their account without proper verification. This can be exploited by an attacker to gain control of the account. The issue is resolved in Flowise version 3.0.10. The CVSS vector for this vulnerability is CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

Patch Flowise to version 3.0.10 or later immediately. Verify that all affected systems have been updated and monitor for suspicious account activity.

Recommended defensive actions

Patch Flowise to version 3.0.10 or later
Verify that all affected systems have been updated
Monitor for suspicious account activity
Restrict access to the account profile endpoint
Implement additional authentication mechanisms for email changes

Evidence notes

The CVE-2025-71337 vulnerability details were obtained from the NVD and CVE.org. The vulnerability affects Flowise versions 3.0.7 and earlier. The CVSS score is 8.7, indicating a HIGH severity vulnerability. A patch is available in Flowise version 3.0.10.

Sources and references

Verified primary and authoritative sources

CVE-2025-71337 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2025-71337

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2025-71337 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2025-71337

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Mitigation or vendor reference
Unverified legacy reference

URL: https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x39m-3393-3qp4

[email protected] - Exploit, Third Party Advisory
Mitigation or vendor reference
Unverified legacy reference

URL: https://www.vulncheck.com/advisories/flowise-unverified-email-change-via-account-profile-endpoint

[email protected] - Third Party Advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.