{"id":"EUVD-2026-27824","enisaUuid":"6f994660-198c-307c-b768-6a3c0ec6d252","description":"A security flaw has been discovered in FlowiseAI Flowise up to 3.0.12. Affected is the function Login of the file packages/server/src/enterprise/services/account.service.ts of the component API Response Handler. The manipulation results in information disclosure. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. You should upgrade the affected component.","datePublished":"May 6, 2026, 12:30:11 PM","dateUpdated":"May 6, 2026, 1:03:55 PM","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X","references":"https://vuldb.com/vuln/361273\nhttps://vuldb.com/vuln/361273/cti\nhttps://vuldb.com/submit/777656\nhttps://gist.github.com/YLChen-007/50a553f09aa1c7c04ce18cec13986a91\n","aliases":"CVE-2026-8026\n","assigner":"VulDB","epss":0.26,"enisaIdProduct":[{"id":"0cbda7c4-53c2-397b-887d-998022ad9763","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"3.0.7"},{"id":"11fb85bc-5cda-31c1-aeeb-4162cf979436","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"3.0.3"},{"id":"1a965645-a16a-374d-a966-80c0c7364d09","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"3.0.4"},{"id":"22e5fc1e-232b-3e76-b6eb-a8f02736cc09","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"3.0.10"},{"id":"3117f46e-389a-346c-84a1-90f1e6d095ec","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"3.0.11"},{"id":"63673e2f-5172-3fd5-9a50-01d1139243b9","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"3.0.9"},{"id":"6558319c-a5c0-3af4-8a81-39e39a14acb0","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"3.0.0"},{"id":"6b49cdea-3e5e-3b89-909a-cdffb9a7ce98","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"3.0.5"},{"id":"70ab5bb0-2890-3c87-94ce-42147f4ab34c","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"3.0.6"},{"id":"8f758126-1038-34a2-8bb9-9d09e0c818a0","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"3.0.12"},{"id":"9b7d08fd-c524-3cbc-a98c-5296a1bcaa1c","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"3.0.1"},{"id":"b7a2eee6-71df-39b1-8619-685f960cabf3","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"3.0.8"},{"id":"f685efbc-7c01-3c2f-8dce-a7deb5fb1202","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"3.0.2"}],"enisaIdVendor":[{"id":"9587ee25-d76c-3f26-be35-a458dfe6709d","vendor":{"name":"FlowiseAI"}}],"enisaIdVulnerability":[{"id":"3e8d8dae-a281-3c4a-bfda-99234e228856","vulnerability":{"id":"GHSA-8f47-4rh3-x44m","description":"Flowise: Bcrypt Password Hash Exposure","datePublished":"May 6, 2026, 3:32:41 PM","dateUpdated":"May 12, 2026, 10:22:13 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-8026\nhttps://gist.github.com/YLChen-007/50a553f09aa1c7c04ce18cec13986a91\nhttps://github.com/FlowiseAI/Flowise\nhttps://vuldb.com/submit/777656\nhttps://vuldb.com/vuln/361273\nhttps://vuldb.com/vuln/361273/cti\n","enisa_id":"EUVD-2026-27824\n","aliases":"CVE-2026-8026\nGHSA-8f47-4rh3-x44m\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"6ed0f8cc-fd8a-3bc4-8ed9-8e051db43ba0","vulnerability":{"id":"CVE-2026-8026","description":"A security flaw has been discovered in FlowiseAI Flowise up to 3.0.12. Affected is the function Login of the file packages/server/src/enterprise/services/account.service.ts of the component API Response Handler. The manipulation results in information disclosure. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. You should upgrade the affected component.","datePublished":"May 6, 2026, 12:30:11 PM","dateUpdated":"May 6, 2026, 1:03:55 PM","status":"PUBLISHED","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X","references":"https://vuldb.com/vuln/361273\nhttps://vuldb.com/vuln/361273/cti\nhttps://vuldb.com/submit/777656\nhttps://gist.github.com/YLChen-007/50a553f09aa1c7c04ce18cec13986a91\n","enisa_id":"EUVD-2026-27824\n","assigner":"VulDB","epss":0.26,"dataProcessed":"Nov 1, 2026, 7:18:48 AM","vulnerabilityProduct":[{"id":"10f96292-7475-3b11-9be8-a6f7a66c78e0","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"3.0.12"},{"id":"2a213257-96e7-385e-9682-d9fec827462f","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"3.0.9"},{"id":"63da0b7c-2e1a-3ef3-bfe5-be03677b6680","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"3.0.7"},{"id":"7f14f738-77b6-3642-90bf-2dd25d2be9a0","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"3.0.5"},{"id":"87a3c281-80f4-3377-9446-39ab79bbd488","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"3.0.11"},{"id":"973d356b-4498-3a92-bc94-23df70230420","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"3.0.3"},{"id":"9aa818b9-6e0a-318d-a279-3e0ae5b85731","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"3.0.10"},{"id":"9d241d17-f177-3e33-a29b-224af92d9a11","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"3.0.8"},{"id":"a2613e0c-ead8-30c0-b836-4a0905fff34d","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"3.0.4"},{"id":"a66a3b58-5aad-3b0b-986c-9d8046c84ea9","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"3.0.1"},{"id":"ab0e3064-640c-36ae-a21d-035141f86a59","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"3.0.6"},{"id":"aee7c7f0-e62e-301c-9361-e0d1b23d148d","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"3.0.0"},{"id":"f9487c12-7cab-352d-b99f-765a553ee7f2","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"3.0.2"}],"vulnerabilityVendor":[{"id":"d1ae12c8-4291-3ac6-848f-579bbb68cb87","vendor":{"name":"FlowiseAI"}}]}}],"enisaIdAdvisory":[]}