Executive Summary

This vulnerability exists in Flowise versions before 3.0.10 and involves an unverified password change feature. An authenticated user can change their account password through the account settings without needing to provide their current password or any other form of verification.

Because the application does not enforce a current-password check when changing credentials, an attacker who can hijack or coerce an authenticated session can exploit this to take over the account completely.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a full account takeover if an attacker gains access to an authenticated session. The attacker can change the account password without knowing the original password, effectively locking out the legitimate user and gaining unauthorized access to the account.

Useful 0 Not Useful 0