CVE-2026-56267

creationtimestamp| type| source ---|---|--- 2026-06-20 20:14:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moqobjpz2b22...

CVE-2026-56267 Flowise - PII Disclosure via Unauthenticated Forgot Password Endpoint

Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoint that returns full user objects including PII to unauthenticated attackers. An attacker can enumerate valid email addresses and harvest sensitive user data including user IDs,...