Unverified Password Change Vulnerability in Flowise by FlowiseAI

CVE-2025-71328

What is CVE-2025-71328?

Flowise prior to version 3.0.10 features a vulnerability that allows authenticated users to change their passwords without verifying their current password. This lack of verification creates an opportunity for malicious actors to compromise accounts, especially if they can gain access to or manipulate authenticated sessions. It's critical for users and administrators to be aware of this vulnerability and apply necessary updates to enhance account security.

References