Executive Summary

This vulnerability exists in FlowiseAI Flowise up to version 3.0.12, specifically in the verify function of the file packages/server/src/enterprise/services/account.service.ts within the Endpoint component.

An attacker can manipulate this function to cause information disclosure. The vulnerability can be exploited remotely, but the attack is considered to have high complexity, meaning it is difficult to exploit.

Although the exploit is difficult, it is publicly available, which increases the risk of exploitation. It is recommended to upgrade the affected component to mitigate this vulnerability.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized information disclosure, meaning sensitive or confidential data could be exposed to attackers.

Since the exploit can be performed remotely, attackers do not need physical access to the system to exploit this vulnerability.

However, the attack complexity is high, so exploiting this vulnerability requires significant effort or expertise.

If exploited, it could compromise the confidentiality of your data, potentially leading to privacy breaches or other security issues.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrading the affected component, FlowiseAI Flowise, to a version later than 3.0.12 is recommended to mitigate this vulnerability.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability CVE-2026-8028 results in the exposure of users' bcrypt password hashes through an unauthenticated endpoint. This unauthorized disclosure of sensitive credential information can lead to offline password cracking and credential stuffing attacks.

Such exposure of personal and sensitive data may violate data protection requirements under common standards and regulations like GDPR and HIPAA, which mandate the protection of user credentials and personal information against unauthorized access and disclosure.

Therefore, organizations using affected versions of FlowiseAI Flowise up to 3.0.12 could face compliance risks if this vulnerability is exploited, as it compromises the confidentiality and integrity of user authentication data.

Upgrading to patched versions is recommended to mitigate these compliance and security risks.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring network traffic for unauthorized or suspicious POST requests to the endpoint /api/v1/account/verify, which is known to return sensitive bcrypt password hashes without authentication.

To detect exploitation attempts or verify if your system is vulnerable, you can use network inspection tools like curl or tcpdump to observe requests and responses to this endpoint.

• Use curl to test the endpoint response: curl -X POST https://your-flowise-domain/api/v1/account/verify -d '{"tempToken":"<token>"}' -H 'Content-Type: application/json' -v
• Use tcpdump or Wireshark to capture and analyze network traffic for POST requests to /api/v1/account/verify that return JSON responses containing bcrypt hashes.
• Check server logs for unusual or repeated POST requests to /api/v1/account/verify, especially those that might indicate attempts to retrieve credential hashes.

Useful 0 Not Useful 0