Mass Assignment Vulnerability in Flowise API Affects User Credential Management

CVE-2026-56276

What is CVE-2026-56276?

Flowise prior to version 3.1.2 contains a mass assignment vulnerability within the /api/v1/user endpoint, enabling authenticated users to alter the credential field without any validation. This flaw permits attackers to bypass password change verification and session invalidation. By providing a manipulated password hash, they can establish persistent access to accounts even after a temporary session compromise, highlighting significant risks to user account security and the integrity of the Flowise platform.

References