{"id":"EUVD-2025-210304","enisaUuid":"939bc7a2-5257-38c7-a3cb-934d1347e101","description":"Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email change vulnerability. An authenticated user can change the account email address, used as a login identifier and password-recovery channel, via the account profile endpoint without confirming the change to the original email address or re-entering the current password. By changing the recovery email, an attacker can take over the account and abuse password reset mechanisms.","datePublished":"Jun 23, 2026, 12:12:52 PM","dateUpdated":"Jun 23, 2026, 1:03:23 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x39m-3393-3qp4\nhttps://www.vulncheck.com/advisories/flowise-unverified-email-change-via-account-profile-endpoint\n","aliases":"CVE-2025-71337\nGHSA-4xff-r326-4qv2\n","assigner":"VulnCheck","epss":0.42,"enisaIdProduct":[{"id":"7d10f7fe-74bc-3cff-983c-7bc991d95104","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"0 \u003c3.0.10"}],"enisaIdVendor":[{"id":"c28cef47-f918-3e52-ba7a-426f59fef299","vendor":{"name":"Flowise"}}],"enisaIdVulnerability":[{"id":"d628747b-98c7-3eb1-afb6-59b378e63aee","vulnerability":{"id":"GHSA-4xff-r326-4qv2","description":"Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email change vulnerability. An authenticated user can change the account email address, used as a login identifier and password-recovery channel, via the account profile endpoint without confirming the change to the original email address or re-entering the current password. By changing the recovery email, an attacker can take over the account and abuse password reset mechanisms.","datePublished":"Jun 23, 2026, 3:32:36 PM","dateUpdated":"Jun 23, 2026, 3:32:36 PM","baseScore":0.0,"references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x39m-3393-3qp4\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-71337\nhttps://www.vulncheck.com/advisories/flowise-unverified-email-change-via-account-profile-endpoint\n","enisa_id":"EUVD-2025-210304\n","aliases":"GHSA-4xff-r326-4qv2\nCVE-2025-71337\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"ebe0df20-0726-31a2-b224-2bd5e750df59","vulnerability":{"id":"CVE-2025-71337","description":"Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email change vulnerability. An authenticated user can change the account email address, used as a login identifier and password-recovery channel, via the account profile endpoint without confirming the change to the original email address or re-entering the current password. By changing the recovery email, an attacker can take over the account and abuse password reset mechanisms.","datePublished":"Jun 23, 2026, 12:12:52 PM","dateUpdated":"Jun 23, 2026, 1:03:23 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x39m-3393-3qp4\nhttps://www.vulncheck.com/advisories/flowise-unverified-email-change-via-account-profile-endpoint\n","enisa_id":"EUVD-2025-210304\n","assigner":"VulnCheck","epss":0.42,"dataProcessed":"Nov 1, 2026, 1:41:55 AM","vulnerabilityProduct":[{"id":"4853c9fe-5f6d-39e5-89bf-6e3b13dcf36b","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"0 \u003c3.0.10"}],"vulnerabilityVendor":[{"id":"acd1d142-cd57-309e-8321-df3551d6046a","vendor":{"name":"Flowise"}}]}}],"enisaIdAdvisory":[{"id":"8fde2f09-0f89-3451-9f77-299999739c84","advisory":{"id":"WID-SEC-W-2025-2591","description":"Flowise: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen","summary":"Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um Sicherheitsvorkehrungen zu umgehen und sich so Zugriff auf Konten zu verschaffen.","datePublished":"Nov 12, 2025, 11:00:00 PM","dateUpdated":"Jun 23, 2026, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-2591.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2025-2591\n","aliases":"CVE-2025-71337\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"54f4b233-a16a-3bc5-bf44-98adfd1bb16d","product":{"name":"3.0.10","vendor":{"name":"open source"}}},{"id":"f4f7ebff-3cd7-35ce-ad95-a0907437bd9a","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}}}]}}]}