CVE-2026-8028

A vulnerability was detected in FlowiseAI Flowise up to 3.0.12. This affects the function verify of the file packages/server/src/enterprise/services/account.service.ts of the component Endpoint. Performing a manipulation results in information disclosure. Remote exploitation of the attack is possible. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit is now public and may be used. Upgrading the affected component is recommended.

• CWE-200
• CWE-284

• https://gist.github.com/YLChen-007/1d52497b0221835f99367be61612746bExploit, Third Party Advisory
• https://vuldb.com/submit/777659Third Party Advisory, VDB Entry
• https://vuldb.com/vuln/361276Third Party Advisory, VDB Entry
• https://vuldb.com/vuln/361276/ctiPermissions Required, VDB Entry

Published

May 6, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-80253An improper physical access control issue exists in ShizenBo…7
• CVE-2026-80254Authorization bypass through user-controlled key issue exist…7.1
• CVE-2026-80255A `Set-Cookie:` header using tab (horizontal tab, ASCII code…7.5
• CVE-2026-8026A security flaw has been discovered in FlowiseAI Flowise up …5.3
• CVE-2026-8027A weakness has been identified in FlowiseAI Flowise up to 3.…5.3
• CVE-2026-80274If a BIND resolver sends a query for a DNSSEC-signed authori…7.5
• CVE-2026-8029The ZTE Smart Life app contains an SQL injection vulnerabili…3.9
• CVE-2026-8030GitLab has remediated an issue in GitLab CE/EE affecting all…4.3
• CVE-2026-8031A vulnerability was detected in PicoTronica e-Clinic Healthc…5.5
• CVE-2026-80311The Stripe Payment Forms by WP Full Pay WordPress plugin be…4.3
• CVE-2026-8032A flaw has been found in PicoTronica e-Clinic Healthcare Sys…7.3
• CVE-2026-8033A vulnerability has been found in PicoTronica e-Clinic Healt…5.5