---
id: CVE-2026-56267
title: Flowise - PII Disclosure via Unauthenticated Forgot Password Endpoint
summary: >-
  Flowise before 3.0.13 contains an information exposure vulnerability in the
  POST /api/v1/account/forgot-password endpoint that returns full user objects
  including PII to unauthenticated attackers. An attacker can enumerate valid
  email ad…
severity: medium
cvss: 6.9
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-200
vendor: Flowise
product: Flowise
affected:
  - Flowise < 3.0.13
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-22T17:27:10.202650Z'
exploitAvailable: true
published: '2026-06-20'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:05:52.503Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-56267'
references:
  - url: >-
      https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-jc5m-wrp2-qq38
    label: GitHub Security Advisory (GHSA-jc5m-wrp2-qq38)
  - url: >-
      https://www.vulncheck.com/advisories/flowise-pii-disclosure-via-unauthenticated-forgot-password-endpoint
    label: >-
      VulnCheck Advisory: Flowise - PII Disclosure via Unauthenticated Forgot
      Password Endpoint
tags:
  - cve.org
  - exploit-available
epss: 0.00465
epssPercentile: 0.40493
ingestedAt: '2026-11-08T14:51:22.361Z'
---

## Overview

Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoint that returns full user objects including PII to unauthenticated attackers. An attacker can enumerate valid email addresses and harvest sensitive user data including user IDs, names, account status, and timestamps by sending requests with known email addresses.

## Affected

- `Flowise < 3.0.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.