Flowise prior to 3.1.2 contains a mass assignment flaw in the PUT /api/v1/user API that lets an authenticated user set the credential field without validation. By supplying a crafted password hash, an attacker can bypass password change checks and session invalidation, essentially creating or replacing an account password. This allows the attacker to retain persistent access after a temporary session compromise, leading to unauthorized control over a user account.

Flowise versions earlier than 3.1.2 across all deployments of the Flowise:Flowise product are affected. Updated releases beginning with 3.1.2 contain the fix, and newer versions are expected to be safe.

The CVSS score of 6.0 indicates a moderate severity flaw. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate to the system and then issue a crafted PUT request to the /api/v1/user endpoint; the exploit requires no special privileges beyond normal user access. Given the ability to override credential hashes, the impact could facilitate long‑term account compromise if the vulnerability is not remediated.