GHSA-59fh-9f3p-7m39: Flowise: Mass Assignment in PUT /api/v1/user Allows Authenticated Users to Override Password Hash and Bypass Password Change Verification

Summary

GHSA-59fh-9f3p-7m39 is a mass assignment flaw in Flowise's PUT /api/v1/user endpoint. The controller forwards the whole request body to userService.updateUser, which merges it into the User entity without a field allowlist. An authenticated user can therefore overwrite the credential field with a chosen bcrypt hash, bypassing old password verification, hashing and policy checks, and session invalidation. The source notes an attacker holding a temporary session, for example via XSS or token theft, could use this for persistent account access, though the ID check prevents changing other users' accounts.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• flowisenpmLLM dependency since 2024-03-12

Related items

• LowFBI arrests Saudi OpenAI employee who allegedly planted recording device in conference roomSimilar attack · CNBC Technology
• MediumVisual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)Similar attack · Embrace The Red
• LowAnthropic warns self-replicating AI could spread to your smart devicesSimilar attack · BleepingComputer
• InfoAnthropic Warns Small AI Models Could Soon Form Self-Propagating IoT BotnetsSimilar attack · The Hacker News
• InfoAgent Baseline Publishes Security Reference Architecture for Software FactoriesSimilar attack · Socket Blog