CVE-2026-8028
Information Disclosure in FlowiseAI Flowise
Publication date: 2026-05-06
Last updated on: 2026-05-06
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| flowiseai | flowise | to 3.0.12 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in FlowiseAI Flowise up to version 3.0.12, specifically in the verify function of the file packages/server/src/enterprise/services/account.service.ts within the Endpoint component.
An attacker can manipulate this function to cause information disclosure. The vulnerability can be exploited remotely, but the attack is considered to have high complexity, meaning it is difficult to exploit.
Although the exploit is difficult, it is publicly available, which increases the risk of exploitation. It is recommended to upgrade the affected component to mitigate this vulnerability.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized information disclosure, meaning sensitive or confidential data could be exposed to attackers.
Since the exploit can be performed remotely, attackers do not need physical access to the system to exploit this vulnerability.
However, the attack complexity is high, so exploiting this vulnerability requires significant effort or expertise.
If exploited, it could compromise the confidentiality of your data, potentially leading to privacy breaches or other security issues.
What immediate steps should I take to mitigate this vulnerability?
Upgrading the affected component, FlowiseAI Flowise, to a version later than 3.0.12 is recommended to mitigate this vulnerability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability CVE-2026-8028 results in the exposure of users' bcrypt password hashes through an unauthenticated endpoint. This unauthorized disclosure of sensitive credential information can lead to offline password cracking and credential stuffing attacks.
Such exposure of personal and sensitive data may violate data protection requirements under common standards and regulations like GDPR and HIPAA, which mandate the protection of user credentials and personal information against unauthorized access and disclosure.
Therefore, organizations using affected versions of FlowiseAI Flowise up to 3.0.12 could face compliance risks if this vulnerability is exploited, as it compromises the confidentiality and integrity of user authentication data.
Upgrading to patched versions is recommended to mitigate these compliance and security risks.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring network traffic for unauthorized or suspicious POST requests to the endpoint /api/v1/account/verify, which is known to return sensitive bcrypt password hashes without authentication.
To detect exploitation attempts or verify if your system is vulnerable, you can use network inspection tools like curl or tcpdump to observe requests and responses to this endpoint.
- Use curl to test the endpoint response: curl -X POST https://your-flowise-domain/api/v1/account/verify -d '{"tempToken":"<token>"}' -H 'Content-Type: application/json' -v
- Use tcpdump or Wireshark to capture and analyze network traffic for POST requests to /api/v1/account/verify that return JSON responses containing bcrypt hashes.
- Check server logs for unusual or repeated POST requests to /api/v1/account/verify, especially those that might indicate attempts to retrieve credential hashes.