PT-2026-51150 · Flowise · Flowise

Tenbbughunters · Published 2026-06-20 · Updated 2026-06-20 · CVE-2026-56267

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.0.13

Description An information exposure issue exists in the 'POST /api/v1/account/forgot-password' endpoint. Unauthenticated attackers can enumerate valid email addresses and harvest sensitive user data, including PII (Personally Identifiable Information), user IDs, names, account status, and timestamps, by sending requests with known email addresses. This occurs because the endpoint returns full user objects.

Recommendations Update to version 3.0.13 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-56267

Affected Products

Flowise

References · 5

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-jc5m-wrp2-qq38 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56267 · Security Note
• https://vulncheck.com/advisories/flowise-pii-disclosure-via-unauthenticated-forgot-password-endpoint · Note
• https://twitter.com/infoflowcloud/status/2068382478998360422 · Twitter Post
• https://twitter.com/CVEnew/status/2068380910349603265 · Twitter Post