{"id":"CVE-2025-71328","revision":"7ce3f953ecb642bdb219549c425b7693","records":[{"revision":"7ce3f953ecb642bdb219549c425b7693","observedAt":"2026-10-25T04:17:18.34+00:00","statement":{"source":"nvd","id":"CVE-2025-71328","aliases":[],"title":"Flowise before 3.0.10 contains an unverified password change vulnerability. An authenticated user can change their account password through the account settings (Security) section without supplying the current password or any additional ver…","description":"Flowise before 3.0.10 contains an unverified password change vulnerability. An authenticated user can change their account password through the account settings (Security) section without supplying the current password or any additional verification, as the application does not enforce a current-password check on the credential change. This can lead to full account takeover, particularly if an attacker can hijack or coerce an authenticated session.","state":0,"publishedAt":"2026-06-25T22:16:58.877+00:00","modifiedAt":"2026-10-12T21:10:00.227+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":8.7,"severity":"HIGH"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","score":8.3,"severity":"HIGH"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-fjh6-8679-9pch","https://www.vulncheck.com/advisories/flowise-unverified-password-change-via-account-settings"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-71328","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-620"],"productCriteria":["cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-06-25T22:16:58.877","lastModified":"2026-10-12T21:10:00.227"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2025-71328","identifiers":["CVE-2025-71328"]},"retained":false,"historicalAffected":[]}],"coverage":[]}