CVE-2026-8026 PUBLISHED

FlowiseAI Flowise API Response account.service.ts login information disclosure

Assigner: VulDB
Reserved: 06.05.2026 Published: 06.05.2026 Updated: 06.05.2026

A security flaw has been discovered in FlowiseAI Flowise up to 3.0.12. Affected is the function Login of the file packages/server/src/enterprise/services/account.service.ts of the component API Response Handler. The manipulation results in information disclosure. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. You should upgrade the affected component.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
CVSS Score: 6.3

Product Status

Vendor FlowiseAI
Product Flowise
Versions
  • Version 3.0.0 is affected
  • Version 3.0.1 is affected
  • Version 3.0.2 is affected
  • Version 3.0.3 is affected
  • Version 3.0.4 is affected
  • Version 3.0.5 is affected
  • Version 3.0.6 is affected
  • Version 3.0.7 is affected
  • Version 3.0.8 is affected
  • Version 3.0.9 is affected
  • Version 3.0.10 is affected
  • Version 3.0.11 is affected
  • Version 3.0.12 is affected

Credits

  • Eric-a (VulDB User) reporter

References

Problem Types

  • Information Disclosure CWE
  • Improper Access Controls CWE