CVE-2025-71327

The /api/v1/account/register endpoint is not covered by an authentication mechanism (CWE-306 — missing critical identity verification). An attacker without any permissions can send a network request to this endpoint and register any user account. After registering the account, the attacker can authenticate with it in the system and gain full access to the Flowise API.

An attacker can remotely and without any credentials create an account in the Flowise system, then log in and gain full access to the API — which may lead to unauthorized data reading, modification, and further system compromise.

Apply patches available from the vendor in accordance with the references (GitHub Security Advisory GHSA-v5w9-prxf-w882). Until the update is applied, it is recommended to restrict network access to the /api/v1/account/register endpoint at the firewall or reverse proxy level.

Flowise (FlowiseAI) — versions indicated in the vendor's references