The Flowise application before version 3.0.10 allows an authenticated user to change their password without providing the current password or any additional verification. This flaw is a direct application of CWE‑620, which enables improper credential updates. Because the new password is accepted immediately, the attacker can immediately assume control of the account. The lack of validation gives full authority to the user, turning the credential change into a complete account takeover via user manipulation or session compromise.

Flowise:Flowise before version 3.0.10 is affected. No other versions have been reported to contain this issue.

The CVSS score of 8.7 indicates a high severity. While the EPSS score is not available, the vulnerability is not listed in the CISA KEV catalog, suggesting it may not yet be officially exploited in the wild. The attack requires an existing authenticated session; an attacker who hijacks or coerces such a session can simply navigate to the account settings page and change the password, gaining full control. As the application does not enforce a current‑password check, any authenticated user can perform this operation, even if they have only limited privileges in the system.