Medium severityNVD Advisory· Published Jun 20, 2026· Updated Jun 22, 2026

CVE-2026-56267

Description

Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoint that returns full user objects including PII to unauthenticated attackers. An attacker can enumerate valid email addresses and harvest sensitive user data including user IDs, names, account status, and timestamps by sending requests with known email addresses.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Npm/Flowiseinferred
Range: <3.0.13
Package: https://npmjs.com/package/flowise
Flowiseai/Flowisellm-fuzzy
Range: <3.0.13

Patches

Vulnerability mechanics

References

github.com/FlowiseAI/Flowise/security/advisories/GHSA-jc5m-wrp2-qq38nvd
www.vulncheck.com/advisories/flowise-pii-disclosure-via-unauthenticated-forgot-password-endpointnvd

News mentions

Flowise: Nine Vulnerabilities Including RCE and SSRF Disclosed in Batch
Vypr Intelligence · Jun 23, 2026

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000