CVE-2025-71337: Flowise Unverified Email Change Vulnerability (CVSS 8.3)

Technical summary

The vulnerability exists in the account profile endpoint of Flowise versions 3.0.7 and earlier. When an authenticated user requests an email change, the application fails to implement standard verification controls: it does not require confirmation of the change via the original email address (email verification link), nor does it require the user to re-enter their current password as proof of authorization. This allows an attacker with valid session credentials to unilaterally modify the account's recovery email. The absence of these controls violates CWE-620 (Improper Validation of Transferred Data Integrity), as the system does not validate that the requester has legitimate authority over the new email address. Combined with password reset functionality that sends recovery tokens to the registered email, this creates a direct path to account compromise.

Business impact

Organizations relying on Flowise for workflow automation face potential compromise of user accounts and loss of session integrity. An attacker with any valid account credential (obtained through phishing, credential stuffing, or insider access) can escalate that single credential into full account control by redirecting the recovery email. This disrupts user productivity, exposes sensitive workflows and integrations configured within Flowise, and creates audit trail complications. For multi-tenant deployments or Flowise instances managing critical automation, this could allow lateral movement or exposure of shared configuration data.

Affected systems

Flowise versions 3.0.7 and earlier are affected. Version 3.0.10 or later resolves the issue. Organizations should verify their deployment version immediately, as any instance running Flowise in the vulnerable range is exposed if any authenticated user account exists.

Exploitability

This vulnerability is exploitable by anyone with valid login credentials—including low-privilege accounts, former employees with residual access, or users whose credentials were compromised in unrelated breaches. No special tools, network positioning, or user interaction are required once authentication is obtained. The attack is silent and leaves minimal forensic evidence if email change logs are not monitored. However, exploitation does require prior authentication, which prevents unauthenticated remote attacks. The CVSS score of 8.3 (HIGH) reflects the ease of exploitation and severe impact on confidentiality and integrity once the account is compromised.

Remediation

Upgrade to Flowise 3.0.10 or later. If immediate patching is not possible, implement supplementary mitigations: enforce multi-factor authentication (MFA) on all user accounts to increase the cost of credential compromise, monitor email change requests and alert on changes from unexpected IP addresses or time windows, restrict account profile endpoint modifications to require re-authentication or email verification, and audit all email changes over the past 30 days to detect unauthorized modifications.

Patch guidance

Upgrade Flowise to version 3.0.10 or later. Verify the upgrade by checking the version string in the application interface or logs. Test the patch in a staging environment first, ensuring integrations and stored workflows continue to function. After deployment, force re-authentication of all active sessions to invalidate any attacker-held credentials and require users to verify their email addresses during the next login. Consider rolling back user email changes made within the past 30 days if email change audit logs are available and show suspicious activity.

Detection guidance

Review Flowise audit and access logs for email change events, particularly those not preceded by password reset requests or followed by subsequent password changes. Monitor for failed login attempts using old email addresses followed by successful logins from new email addresses on the same account. Check for email change requests originating from IP addresses or geographic regions inconsistent with normal user behavior. Enable alerts on API calls to the account profile endpoint that modify the email field without corresponding verification steps. If Flowise exposes email change events via webhooks or audit logs, integrate these into your SIEM for real-time correlation with password reset or suspicious authentication activity.

Why prioritize this

This vulnerability merits urgent patching because it directly enables account takeover without requiring the attacker to know the current password or regain access post-compromise. Unlike many authentication flaws that require complex exploitation chains, this one is straightforward and silent. Combined with the HIGH CVSS score and the fact that affected versions are widely deployed, the risk of exploitation in the wild is substantial. Flowise instances managing sensitive integrations (cloud storage, databases, APIs, payment systems) are especially high-priority targets.

Risk score, explained

The CVSS 3.1 score of 8.3 reflects: Network-accessible endpoint (AV:N), no special conditions needed for exploitation (AC:L), requirement for authentication (PR:L) which partially mitigates but does not prevent exploitation, absence of scope change (S:U), high impact on confidentiality and integrity of the affected account (C:H, I:H), and low impact on availability (A:L). The score appropriately penalizes the lack of email verification or password confirmation controls. It does not account for the widespread deployment of Flowise or the likelihood of prior credential compromise in supply chain attacks, which would justify prioritization even if the score were slightly lower.

Frequently asked questions