Flowise – PII Disclosure via Unauthenticated Forgot Password Endpoint_CVE-2026-56267
Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoint that returns full user objects including PII to unauthenticated attackers. An attacker can enumerate valid email addresses and harvest sensitive user data ...