CVE-2026-56267: Flowise Information Disclosure Flaw

CVE-2026-56267 Overview

CVE-2026-56267 is an information exposure vulnerability in Flowise versions before 3.0.13. The POST /api/v1/account/forgot-password endpoint returns full user objects to unauthenticated requesters. Returned data includes user IDs, names, account status, email addresses, and timestamps. Attackers can enumerate valid accounts and harvest personally identifiable information (PII) by sending requests with candidate email addresses. The flaw is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated attackers can confirm valid user accounts and extract PII from Flowise deployments, enabling targeted phishing, credential stuffing, and follow-on account takeover campaigns.

Affected Products

Flowise versions prior to 3.0.13
Self-hosted Flowise deployments exposing the account API to untrusted networks
Managed Flowise instances on versions earlier than 3.0.13

Discovery Timeline

2026-06-20 - CVE-2026-56267 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-56267

Vulnerability Analysis

The vulnerability resides in the password reset workflow exposed by Flowise. The POST /api/v1/account/forgot-password endpoint accepts an email address from any unauthenticated caller. Instead of returning a generic acknowledgment, the endpoint responds with the matched user record. The response body contains the user identifier, display name, account status, email, and creation or update timestamps.

This behavior breaks two security principles. First, the endpoint discloses sensitive PII without authentication. Second, the differential response between valid and invalid email addresses enables account enumeration. An attacker scripting requests across an email list can build a verified user inventory in minutes.

The harvested data supports targeted phishing, credential stuffing against the Flowise login, and lateral reconnaissance against connected AI workflows. Because Flowise is commonly used to orchestrate LLM agents, exposed accounts often have access to proprietary prompts and API keys.

Root Cause

The forgot-password handler returns the full user object retrieved from the database lookup. The implementation does not strip sensitive fields and does not normalize responses between hit and miss conditions. A secure design would always return an identical generic response and trigger any reset email asynchronously.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends an HTTP POST request to the forgot-password endpoint with a candidate email in the JSON body. A valid email returns the user record; an invalid email returns an error. Iterating across a wordlist or breached email corpus enumerates accounts at scale.

The vulnerability is described in prose only. See the GitHub Security Advisory GHSA-jc5m-wrp2-qq38 and the VulnCheck Security Advisory for additional technical context.

Detection Methods for CVE-2026-56267

Indicators of Compromise

High volumes of unauthenticated POST requests to /api/v1/account/forgot-password from a single source or distributed sources
Sequential or dictionary-style email values submitted to the forgot-password endpoint within short time windows
Response payloads from the endpoint containing user object fields such as id, name, status, and timestamps
Spikes in 200-status responses from the forgot-password route correlated with no corresponding password reset completions

Detection Strategies

Parse web server and reverse-proxy logs for /api/v1/account/forgot-password request rates that exceed normal baselines
Alert on a single client IP submitting more than a small number of unique email values to the endpoint within an hour
Inspect response sizes for the endpoint; large payloads indicate the vulnerable behavior is still active

Monitoring Recommendations

Forward Flowise application and proxy logs to a centralized analytics platform for retention and correlation
Track per-IP request rate and unique-email cardinality against the account API as a recurring metric
Monitor downstream account activity such as password reset completion ratios to detect enumeration without reset follow-through

How to Mitigate CVE-2026-56267

Immediate Actions Required

Upgrade Flowise to version 3.0.13 or later on all self-hosted and managed deployments
Place the Flowise account API behind an authenticated reverse proxy or VPN until the upgrade is complete
Rotate credentials and API keys for any user records that may have been enumerated
Notify users whose accounts were exposed and enforce password resets where appropriate

Patch Information

The maintainers fixed the issue in Flowise 3.0.13. Review the GitHub Security Advisory GHSA-jc5m-wrp2-qq38 for the patched commit and upgrade instructions. The fix normalizes the forgot-password response so that hits and misses return the same generic acknowledgment without exposing user fields.

Workarounds

Apply a reverse-proxy rule that drops or rate-limits requests to /api/v1/account/forgot-password from untrusted networks
Configure a web application firewall (WAF) to throttle the endpoint to a low request-per-minute threshold per source IP
Restrict the Flowise account API to internal networks or trusted identity-aware proxies until the upgrade is deployed

bash

# Example NGINX rate limit for the forgot-password endpoint
limit_req_zone $binary_remote_addr zone=flowise_fp:10m rate=5r/m;

location /api/v1/account/forgot-password {
    limit_req zone=flowise_fp burst=2 nodelay;
    proxy_pass http://flowise_upstream;
}