CVE-2025-71337 Flowise - Unverified Email Change via Account Profile Endpoint

High 8.7 Published 23 Jun 2026 Updated 23 Jun 2026

Authenticated users can change their recovery email without verification, enabling account takeover via password reset mechanisms.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-71337?

CVE-2025-71337 is a high-severity vulnerability in Flowiseai Flowise, published on 23 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email change vulnerability. An authenticated user can change the account email address, used as a login identifier and password-recovery channel, via the account profile endpoint without confirming the change to the original email address or re-entering the current password. By changing the recovery email, an attacker can take over the account and abuse password reset mechanisms.

Weakness: CWE-620

Which versions are affected by CVE-2025-71337?

2 open source packages ship an affected version, including flowise-ui. It affects 1 product.

Package	Affected	Fixed in
`flowise-ui` npm	All versions	`3.0.10`
`flowise-ui` npm	All versions	`3.0.10`

Products include Flowiseai Flowise.

How do I fix CVE-2025-71337?

Upgrade flowise-ui to 3.0.10 or later.

Is CVE-2025-71337 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-71337 exists.

All Flowiseai Flowise vulnerabilities

Sources

Also known as GHSA-4xff-r326-4qv2, GHSA-x39m-3393-3qp4.