Medium
Flowise - PII Disclosure via Unauthenticated Forgot Password Endpoint
Type: advisorySources: OSV
Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoint that returns full user objects including PII to unauthenticated attackers. An attacker can enumerate valid email addresses and harvest sensitive user data including user IDs, names, account status, and timestamps by sending requests with known email addresses.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-56267
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 15:11 UTC · Revision 1
Source evidence
Flowise - PII Disclosure via Unauthenticated Forgot Password Endpoint
core-osv · Original sourcePublished 20 Jun 2026, 15:24 UTC
Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoint that returns full user objects including PII to unauthenticated attackers. An attacker can enumerate valid email addresses and harvest sensitive user data including user IDs, names, account status, and timestamps by sending requests with known email addresses.
osv:CVE-2026-56267
Complete source record
{
"id": "29769e90fa9a3be76ef9ecd1ec23adb44ce68e124df04987237e34e2afe44995",
"url": "https://osv.dev/vulnerability/CVE-2026-56267",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Flowise - PII Disclosure via Unauthenticated Forgot Password Endpoint",
"summary": "Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoint that returns full user objects including PII to unauthenticated attackers. An attacker can enumerate valid email addresses and harvest sensitive user data including user IDs, names, account status, and timestamps by sending requests with known email addresses.",
"evidence": "osv:CVE-2026-56267",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-56267",
"aliases": [
"CVE-2026-56267",
"GHSA-jc5m-wrp2-qq38"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/flowiseai/flowise",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "f0c1294173a55f26e0b972c39c0c16917f5ca9e7"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "3.0.13"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "0"
},
{
"fixed": "3.0.13"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"versions": [
"flowise@3.0.12",
"flowise-ui@3.0.12",
"flowise-components@3.0.12",
"flowise@3.0.11",
"flowise-ui@3.0.11",
"flowise-components@3.0.11",
"flowise@3.0.10",
"flowise-ui@3.0.10",
"flowise-components@3.0.10",
"flowise@3.0.9",
"flowise-ui@3.0.9",
"flowise-components@3.0.9",
"flowise@3.0.8",
"flowise-ui@3.0.8",
"flowise-components@3.0.8",
"flowise@3.0.7",
"flowise-ui@3.0.7",
"flowise-components@3.0.7",
"flowise@3.0.6",
"flowise-ui@3.0.6",
"flowise-components@3.0.6",
"flowise@3.0.5",
"flowise-ui@3.0.5",
"flowise-components@3.0.5",
"flowise@3.0.4",
"flowise-ui@3.0.4",
"flowise-components@3.0.4",
"flowise@3.0.3",
"flowise-ui@3.0.3",
"flowise-components@3.0.3",
"flowise@3.0.2",
"flowise-ui@3.0.2",
"flowise-components@3.0.2",
"flowise@3.0.1",
"flowise-ui@3.0.1",
"flowise-components@3.0.1",
"flowise@3.0.0",
"flowise-ui@3.0.0",
"flowise-components@3.0.0",
"flowise@2.2.8",
"flowise-ui@2.2.8",
"flowise-components@2.2.8",
"flowise@2.2.7-patch.1",
"flowise-ui@2.2.7-patch.1",
"flowise-components@2.2.7-patch.1",
"flowise@2.2.7",
"flowise-ui@2.2.7",
"flowise-components@2.2.7",
"flowise@2.2.6-hotfix.1",
"flowise@2.2.6",
"flowise-ui@2.2.6",
"flowise-components@2.2.6",
"flowise@2.2.5",
"flowise-ui@2.2.5",
"flowise-components@2.2.5",
"flowise@2.2.4",
"flowise-ui@2.2.4",
"flowise-components@2.2.4",
"flowise@2.2.3",
"flowise-ui@2.2.3",
"flowise-components@2.2.3",
"flowise@2.2.2",
"flowise-ui@2.2.2",
"flowise-components@2.2.2",
"flowise@2.2.1",
"flowise-ui@2.2.1",
"flowise-components@2.2.1",
"flowise@2.2.0",
"flowise-ui@2.2.0",
"flowise-components@2.2.0",
"flowise@2.1.5",
"flowise-ui@2.1.5",
"flowise-components@2.1.5",
"flowise@2.1.4",
"flowise-ui@2.1.4",
"flowise-components@2.1.4",
"flowise@2.1.3",
"flowise-ui@2.1.3",
"flowise-components@2.1.3",
"flowise@2.1.2",
"flowise-ui@2.1.2",
"flowise-components@2.1.2",
"flowise@2.1.1",
"flowise-ui@2.1.1",
"flowise-components@2.1.1",
"flowise@2.1.0",
"flowise-ui@2.1.0",
"flowise-components@2.1.0",
"flowise@2.0.7",
"flowise-ui@2.0.7",
"flowise-components@2.0.7",
"flowise@2.0.6",
"flowise-ui@2.0.6",
"flowise-components@2.0.6",
"flowise@2.0.5",
"flowise-ui@2.0.5",
"flowise-components@2.0.5",
"flowise@2.0.4",
"flowise-ui@2.0.4",
"flowise-components@2.0.4",
"flowise@2.0.3",
"flowise-ui@2.0.3",
"flowise-components@2.0.3",
"flowise@2.0.2",
"flowise-ui@2.0.2",
"flowise-components@2.0.2",
"flowise@1.8.4",
"flowise-ui@1.8.4",
"flowise-components@1.8.6",
"flowise@1.8.3",
"flowise-ui@1.8.3",
"flowise-components@1.8.4",
"flowise@1.8.2",
"flowise-ui@1.8.2",
"flowise-components@1.8.3",
"flowise@1.8.1",
"flowise-ui@1.8.1",
"flowise-components@1.8.1",
"flowise@1.8.0",
"flowise-ui@1.8.0",
"flowise-components@1.8.0",
"flowise@1.7.2",
"flowise-ui@1.7.2",
"flowise-components@1.7.2",
"flowise@1.7.1",
"flowise-ui@1.7.1",
"flowise-components@1.7.1",
"flowise@1.7.0",
"flowise-ui@1.7.0",
"flowise-components@1.7.0",
"flowise@1.6.6",
"flowise-ui@1.6.6",
"flowise-components@1.6.8",
"flowise@1.6.5",
"flowise-ui@1.6.5",
"flowise-components@1.6.7",
"flowise@1.6.4",
"flowise-ui@1.6.4",
"flowise-components@1.6.6",
"flowise@1.6.3",
"flowise-ui@1.6.3",
"flowise-components@1.6.5",
"flowise@1.6.2",
"flowise-ui@1.6.2",
"flowise-components@1.6.4",
"flowise@1.6.1",
"flowise-ui@1.6.1",
"flowise-components@1.6.3",
"flowise@1.6.0",
"flowise-ui@1.6.0",
"flowise-components@1.6.2",
"flowise@1.5.1",
"flowise-ui@1.5.1",
"flowise-components@1.6.1",
"flowise@1.5.0",
"flowise-ui@1.5.0",
"flowise-components@1.6.0",
"flowise@1.4.12",
"flowise-ui@1.4.9",
"flowise-components@1.5.3",
"flowise@1.4.11",
"flowise-ui@1.4.8",
"flowise-components@1.5.2",
"flowise@1.4.10",
"flowise-ui@1.4.7",
"flowise-components@1.5.1",
"flowise@1.4.9",
"flowise@1.4.8",
"flowise-ui@1.4.6",
"flowise-components@1.5.0",
"flowise@1.4.7",
"flowise-ui@1.4.5",
"flowise-components@1.4.9",
"flowise-components@1.4.8",
"flowise@1.4.6",
"flowise-ui@1.4.4",
"flowise-components@1.4.7",
"flowise@1.4.5",
"flowise-ui@1.4.3",
"flowise@1.4.4",
"flowise-ui@1.4.2",
"flowise-components@1.4.6",
"flowise@1.4.2",
"flowise-components@1.4.2",
"flowise@1.4.1",
"flowise-components@1.4.1",
"flowise@1.4.0",
"flowise-ui@1.4.0",
"flowise-components@1.4.0",
"flowise@1.3.9",
"flowise-ui@1.3.7",
"flowise-components@1.3.11",
"flowise-components@1.3.10",
"flowise@1.3.8",
"flowise-ui@1.3.6",
"flowise-components@1.3.9",
"flowise@1.3.7",
"flowise-ui@1.3.5",
"flowise-components@1.3.8",
"flowise@1.3.6",
"flowise-ui@1.3.4",
"flowise-components@1.3.7",
"flowise@1.3.5",
"flowise-ui@1.3.3",
"flowise-components@1.3.5",
"flowise@1.3.4",
"flowise-ui@1.3.2",
"flowise-components@1.3.4",
"flowise@1.3.3",
"flowise-ui@1.3.1",
"flowise-components@1.3.3",
"flowise@1.3.2",
"flowise-components@1.3.2",
"flowise@1.3.1",
"flowise-components@1.3.1",
"flowise@1.3.0",
"flowise-ui@1.3.0",
"flowise-components@1.3.0",
"flowise@1.2.16",
"flowise-ui@1.2.15",
"flowise-components@1.2.17",
"flowise@1.2.15",
"flowise-ui@1.2.14",
"flowise-components@1.2.16",
"flowise@1.2.14",
"flowise-ui@1.2.13",
"flowise-components@1.2.15",
"flowise@1.2.13",
"flowise-ui@1.2.12",
"flowise-components@1.2.14",
"flowise@1.2.11",
"flowise-ui@1.2.10",
"flowise-components@1.2.12",
"flowise@1.2.9",
"flowise-components@1.2.10",
"flowise@1.2.8",
"flowise-ui@1.2.7",
"flowise-components@1.2.9",
"flowise@1.2.7",
"flowise-ui@1.2.6",
"flowise-components@1.2.8",
"flowise@1.2.6",
"flowise-ui@1.2.5",
"flowise-components@1.2.7",
"flowise@1.2.5",
"flowise-ui@1.2.4",
"flowise-components@1.2.6",
"flowise@1.2.4",
"flowise-ui@1.2.3",
"flowise-components@1.2.5",
"flowise@1.2.3",
"flowise-ui@1.2.2",
"flowise-components@1.2.4",
"flowise-components@1.2.3",
"flowise@1.2.2",
"flowise-ui@1.2.1",
"flowise-components@1.2.2",
"flowise@1.2.1",
"flowise-ui@1.2.0",
"flowise-components@1.2.1",
"flowise@1.1.1",
"flowise-components@1.1.1",
"flowise@1.1.0",
"flowise-ui@1.1.0",
"flowise-components@1.1.0",
"flowise@1.0.1",
"flowise@1.0.0",
"flowise-ui@1.0.0",
"flowise-components@1.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56267.json"
}
}
],
"modified": "2026-10-28T02:30:29.830758Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56267.json",
"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-jc5m-wrp2-qq38",
"https://nvd.nist.gov/vuln/detail/CVE-2026-56267",
"https://www.vulncheck.com/advisories/flowise-pii-disclosure-via-unauthenticated-forgot-password-endpoint"
],
"provider_metadata": {
"cwe_ids": [
"CWE-200"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56267.json"
}
},
"related_cves": [
{
"value": "CVE-2026-56267",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 496700,
"published_at": "2026-06-20T15:24:43.347+00:00"
}