Skip to content

Bypass of Password Confirmation - Unverified Email Change (credentials)

High
HenryHengZJ published GHSA-x39m-3393-3qp4 Nov 12, 2025

Package

No package listed

Affected versions

<= [email protected] Latest

Patched versions

3.0.10

Description

Hi Team,

Summary

Unverified Email Change - Email as part of Credential / Unverified Account Recovery Channel Change

The application allows changing the account email address (used as a login identifier and/or password recovery address) without verifying the requester’s authority to make that change (no confirmation to the old email, no authentication step). Because email often functions as a credential or recovery channel, unverified email changes enable attackers to take over accounts by switching the account’s recovery/login address.

Details

Occurence - code:
https://github.com/FlowiseAI/Flowise/blob/main/packages/ui/src/views/account/index.jsx#L211

Remote and physical scenarios can be considered.

PoC

Repro steps:

  1. As logged in user https://cloud.flowiseai.com/account scroll down to 'Profile' section
  2. Change email to the new email
  3. Notice Unverified Password Change (authenticated change without current password)

Later this email is needed as credentials to log in or reset password feature.

POC:
Email changed, and notice "Profile updated" message.

Screenshot
secbug

Impact

Full account takeover (ATO) of affected accounts (loss of confidentiality and integrity of account data).
User account recovery mechanisms (password reset flows tied to email) can be bypassed or abused if combined with this issue and the second one which I've reported (similar security issue with the password - part of credentials). (gain persistence)

References
CWE-620 - Unverified Password Change. https://cwe.mitre.org/data/definitions/620.html (part of credentials)
OWASP - Broken Access Control (context for authorization failures enabling such bypasses)
CWE-306: Missing Authentication for Critical Function

Best regards,

Severity

High

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

CVE ID

No known CVE

Weaknesses

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. Learn more on MITRE.

Unverified Password Change

When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication. Learn more on MITRE.

Credits