CVE-2025-58434

Flowise was vulnerable in versions up to 3.0.5 where the forgot-password API returned a valid tempToken and other sensitive user data without authentication, enabling an unauthenticated attacker to reset passwords and take over accounts (including admins). A fix was released in version 3.0.6 that...