CVE-2026-56267 Flowise - PII Disclosure via Unauthenticated Forgot Password Endpoint
Unauthenticated attackers can harvest sensitive user PII and enumerate valid emails via the forgot-password endpoint in Flowise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-56267?
CVE-2026-56267 is a medium-severity vulnerability in Flowise, published on 20 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoint that returns full user objects including PII to unauthenticated attackers. An attacker can enumerate valid email addresses and harvest sensitive user data including user IDs, names, account status, and timestamps by sending requests with known email addresses.
Weakness: CWE-200
Which versions are affected by CVE-2026-56267?
2 open source packages ship an affected version, including flowise.
| Package | Affected | Fixed in |
|---|---|---|
flowise npm | All versions | 3.0.13 |
flowise npm | All versions | 3.0.13 |
How do I fix CVE-2026-56267?
Upgrade flowise to 3.0.13 or later.
Is CVE-2026-56267 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-56267 exists.
Sources
Also known as GHSA-2mv8-gxwc-hq84, GHSA-jc5m-wrp2-qq38.