CVE-2025-71328
High · 8.3CVSS
8.3
EPSS
0.5%
Published
Jun 25, 2026
CISA due date
—
The record
Flowise before 3.0.10 contains an unverified password change vulnerability. An authenticated user can change their account password through the account settings (Security) section without supplying the current password or any additional verification, as the application does not enforce a current-password check on the credential change. This can lead to full account takeover, particularly if an attacker can hijack or coerce an authenticated session.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-97380 MariaDB server is a community developed fork of MySQL server. CWE-620
- CVE-2026-85591 phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user… CWE-620
- CVE-2026-73292 Semaphore UI is a web interface for managing DevOps tools. CWE-620
- CVE-2026-54801 A vulnerability has been identified in CPCI85 Central Processing/Communication (All… CWE-620
- CVE-2026-44733 OpenProject is open-source, web-based project management software. CWE-620
- CVE-2025-71337 Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email… CWE-620
- CVE-2026-5386 The affected KMW CCTV Security Cameras are vulnerable to a critical unauthenticated… CWE-620
- CVE-2026-8327 Concrete CMS below 9.5.0 and below is vulnerable to password change without… CWE-620