Low severity · published May 6, 2026
CVE-2026-8028
FlowiseAI Flowise Endpoint account.service.ts verify information disclosure
3.7
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was detected in FlowiseAI Flowise up to 3.0.12. This affects the function verify of the file packages/server/src/enterprise/services/account.service.ts of the component Endpoint. Performing a manipulation results in information disclosure. Remote exploitation of the attack is possible. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit is now public and may be used. Upgrading the affected component is recommended.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
Flowise · FlowiseAI
3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; 3.0.5; +7 more · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-8028
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-8028
Exploit
https://gist.github.com/YLChen-007/1d52497b0221835f99367be61612746b
Third Party Advisory
https://vuldb.com/submit/777659
Third Party Advisory
https://vuldb.com/vuln/361276
Permissions Required
https://vuldb.com/vuln/361276/cti
More from Flowise
10.0
CVE-2026-70478
Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service
10.0
CVE-2025-59528
Flowise has Remote Code Execution vulnerability
9.9
CVE-2026-73602
Flowise before 3.1.3 Sandbox Escape to RCE
9.9
CVE-2026-67622
Flowise 3.1.4 IDOR in OpenAI Assistants Integration
9.9
CVE-2026-56274
Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccess
