High severity8.3NVD Advisory· Published Jun 23, 2026· Updated Jun 25, 2026
CVE-2025-71337
CVE-2025-71337
Description
Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email change vulnerability. An authenticated user can change the account email address, used as a login identifier and password-recovery channel, via the account profile endpoint without confirming the change to the original email address or re-entering the current password. By changing the recovery email, an attacker can take over the account and abuse password reset mechanisms.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
2- github.com/FlowiseAI/Flowise/security/advisories/GHSA-x39m-3393-3qp4nvdExploitThird Party Advisory
- www.vulncheck.com/advisories/flowise-unverified-email-change-via-account-profile-endpointnvdThird Party Advisory
News mentions
1- Flowise: Nine Vulnerabilities Including RCE and SSRF Disclosed in BatchVypr Intelligence · Jun 23, 2026