6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-8026

CVE-2026-8026: Flowise: Bcrypt Password Hash Exposure

A security flaw has been discovered in FlowiseAI Flowise up to 3.0.12. Affected is the function Login of the file packages/server/src/enterprise/services/account.service.ts of the component API Response Handler. The manipulation results in information disclosure. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. You should upgrade the affected component.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-8026

CVE-2026-8026:

6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
flowise	npm	<= 3.0.12

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the improper handling of sensitive user data within the AccountService of the Flowise application. Specifically, the login and saveInviteAccount functions retrieve complete user objects from the database, which include sensitive information like the bcrypt-hashed password. Instead of sanitizing these objects to remove the password hash before sending them back to the client, the functions return the raw, unsanitized data. The corresponding controller functions, AccountController.login and AccountController.invite, then take this sensitive data and directly include it in the JSON response to the user. This allows an authenticated attacker to retrieve the password hashes of users, which they can then attempt to crack offline. The vulnerability is a result of an incomplete security fix that failed to apply sanitization to all relevant code paths.

Vulnerable functions

AccountService.login

packages/server/src/enterprise/services/account.service.ts

The `login` function in `account.service.ts` retrieves a user's data from the database, including their hashed password. Instead of sanitizing this data and removing sensitive information, it returns the complete user object, exposing the password hash in the API response.

AccountService.saveInviteAccount

packages/server/src/enterprise/services/account.service.ts

The `saveInviteAccount` function has a code path for when an invited user already exists. In this case, it fetches the existing user's data and includes it in the response without removing the password hash, leading to information disclosure.

AccountController.login

packages/server/src/enterprise/controllers/account.controller.ts

This controller function acts as the entry point for the vulnerable `/api/v1/account/login` endpoint. It calls the vulnerable `AccountService.login` function and serializes its unsanitized output directly into the HTTP response, exposing the user's password hash.

AccountController.invite

packages/server/src/enterprise/controllers/account.controller.ts

This controller function is the entry point for the `/api/v1/account/invite` endpoint. It calls the vulnerable `AccountService.saveInviteAccount` function and returns its output, which can contain a user's password hash if the invited user already exists.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.