-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability lies in an unprotected registration endpoint /api/v1/account/register. By analyzing the routing of the application, I was able to trace this endpoint to the register function in the AccountController. The file packages/server/src/enterprise/routes/account.route.ts defines the route router.post('/register', accountController.register). There is no authentication or authorization middleware applied to this route, which means it is publicly accessible. The register function in packages/server/src/enterprise/controllers/account.controller.ts proceeds to create a new user account based on the request body. This allows an attacker to create a new user even after the initial setup of the application, thus bypassing authentication.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| flowise | npm | = 3.0.1 |