A critical information disclosure vulnerability in Flowise 3.0.5 and earlier allows unauthenticated attackers to extract sensitive data via the forgot-password endpoint.

This is a missing authentication vulnerability (CWE-306) affecting the forgot-password endpoint. The service fails to properly secure this critical function, allowing an unauthenticated attacker to retrieve sensitive information.

The CVSS score of 9.8 indicates a maximum severity, reflecting that the vulnerability is easily exploitable over the network without user interaction. Exposure of sensitive data through this endpoint could lead to full system compromise, loss of intellectual property contained within LLM flows, and complete unauthorized administrative access.

Immediate Action: Update Flowise to version 3.0.6 or later immediately to resolve the authentication bypass.

Proactive Monitoring: Monitor logs for high volumes of requests to the forgot-password endpoint, which may indicate automated scanning or exploitation attempts.

Compensating Controls: If an immediate update is not possible, restrict access to the Flowise management interface to trusted IP addresses using a WAF or VPN.

Public Exploit Available: Yes — a public exploit is available via ExploitDB and detection templates exist in Nuclei.

Due to the availability of public exploits and the critical nature of the vulnerability, immediate patching is required. Organizations running Flowise must upgrade to version 3.0.6 to prevent unauthorized system access and data breach.