Flowise before version 3.0.13 has an information exposure flaw in the POST /api/v1/account/forgot-password endpoint that returns complete user objects—including personally identifiable information—to anyone who can reach the endpoint. The data leaked includes user IDs, names, account status, and timestamps. This vulnerability is classified as CWE-200 and carries a CVSS score of 6.9, indicating moderate severity.

The flaw affects deployments of Flowise:Flowise running any version earlier than 3.0.13. Users of older releases that expose the forgot‑password API to the internet are vulnerable.

Because authentication is not required to invoke the endpoint, an attacker can supply any email address in a POST request and obtain the corresponding user record if the address exists. The lack of an EPSS score and absence from the KEV catalog suggest that widespread exploitation is not yet documented, but the straightforward attack path and moderate CVSS score present a tangible risk to confidentiality.」