CVE-2026-8028
Last modified
CVE-2026-8028 is a low-severity vulnerability rated 3.7/10 on the CVSS scale. A vulnerability was detected in FlowiseAI Flowise up to 3.0.12. This affects the function verify of the file packages/server/src/enterprise/services/account.service.ts of the component Endpoint. EPSS estimates a 0.40% chance of exploitation in the next 30 days.
Description
A vulnerability was detected in FlowiseAI Flowise up to 3.0.12. This affects the function verify of the file packages/server/src/enterprise/services/account.service.ts of the component Endpoint. Performing a manipulation results in information disclosure. Remote exploitation of the attack is possible. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit is now public and may be used. Upgrading the affected component is recommended.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Flowiseai | Flowise | <= 3.0.12 |
References
- https://gist.github.com/YLChen-007/1d52497b0221835f99367be61612746bExploit, Third Party Advisory
- https://vuldb.com/submit/777659Third Party Advisory, VDB Entry
- https://vuldb.com/vuln/361276Third Party Advisory, VDB Entry
- https://vuldb.com/vuln/361276/ctiPermissions Required, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-8028?
How severe is CVE-2026-8028?
How do I fix CVE-2026-8028?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-8022Inappropriate implementation in MHTML in Google Chrome prior…3.1
- CVE-2026-8023Zephyr's HTTP server (subsys/net/lib/http) provides a static…7.5
- CVE-2026-8024A remote, unauthenticated attacker may exploit a deserializa…9.8
- CVE-2026-8025Improper neutralization of special elements used in an SQL c…9.8
- CVE-2026-8026A security flaw has been discovered in FlowiseAI Flowise up …5.3
- CVE-2026-8027A weakness has been identified in FlowiseAI Flowise up to 3.…5.3
- CVE-2026-8029The ZTE Smart Life app contains an SQL injection vulnerabili…3.9
- CVE-2026-8031A vulnerability was detected in PicoTronica e-Clinic Healthc…5.5
- CVE-2026-8032A flaw has been found in PicoTronica e-Clinic Healthcare Sys…7.3
- CVE-2026-8033A vulnerability has been found in PicoTronica e-Clinic Healt…5.5
- CVE-2026-8034A server-side request forgery (SSRF) vulnerability was ident…9.8
- CVE-2026-8035Improper input validation in the NI-PAL kernel driver may al…5.5
Are you affected by CVE-2026-8028?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST