GHSA-59FH-9F3P-7M39

A Mass Assignment vulnerability in the PUT /api/v1/user endpoint allows authenticated users to directly modify restricted user fields, including the credential (password hash), bypassing the intended password change workflow.

Because the endpoint forwards the entire request body to the service layer without filtering, an attacker can override the credential field without providing the current password.

This bypasses several security protections including:

• old password verification
• password hashing enforcement
• password policy validation
• session invalidation on password change

While the vulnerability cannot be used to modify other users due to an ID check in the controller, it allows attackers who obtain a temporary session (e.g., via token theft or XSS) to establish persistent account access.

Details

The endpoint PUT /api/v1/user allows authenticated users to update their user profile.

The controller checks that the authenticated user matches the provided id, preventing direct IDOR:

const currentUser = req.user
const { id } = req.body

if (currentUser.id !== id) {
    throw new InternalFlowiseError(StatusCodes.FORBIDDEN)
}

However, the controller forwards the entire request body directly to the service layer without filtering:

const user = await userService.updateUser(req.body)

Inside UserService.updateUser, the incoming data is merged into the existing user entity:

updatedUser = queryRunner.manager.merge(User, oldUserData, newUserData)

Because newUserData is derived from req.body and there is no field allowlist, any field present in the User entity may be modified.

This includes sensitive fields such as:

• credential
• tempToken
• tokenExpiry
• status
• email

The service implements a secure password change workflow that requires the following fields:

oldPassword
newPassword
confirmPassword

Example code:

if (newUserData.oldPassword && newUserData.newPassword && newUserData.confirmPassword) {
    if (!compareHash(newUserData.oldPassword, oldUserData.credential)) {
        throw new InternalFlowiseError(StatusCodes.BAD_REQUEST)
    }

    newUserData.credential = this.encryptUserCredential(newUserData.newPassword)
}

However, this logic can be bypassed by directly supplying a credential value in the request body.

Because the merge operation applies all fields from newUserData, the supplied credential hash will overwrite the stored password hash.

PoC

Step 1 - Authenticate

Login as any normal user and obtain a valid JWT token.

POST /api/v1/auth/login

Step 2 - Generate a password hash

Generate a bcrypt hash for a password you control.

Example:

bcrypt("attacker_password")

Example hash:

$2b$10$abc123examplehashvalue...

Step 3 - Send crafted update request

PUT /api/v1/user
Authorization: Bearer <JWT_TOKEN>
Content-Type: application/json

{
  "id": "<your-user-id>",
  "credential": "$2b$10$abc123examplehashvalue..."
}

Step 4 - Login with attacker password

The password hash in the database is replaced by the supplied value.

The attacker can now authenticate using:

attacker_password

without ever providing the previous password.

This vulnerability allows authenticated users to bypass the password change security controls.

Security protections that are bypassed include:

current password verification

password hashing enforcement

password policy validation

session invalidation on password change

Although the controller prevents modification of other users' accounts, the vulnerability enables persistence after account compromise.

Example attack scenario:

• An attacker temporarily obtains a user's session (XSS, token leak, shared device, etc.)
• The attacker sends the crafted update request with a new password hash
• The attacker now permanently controls the account
• Authentication logic bypass
• Privilege persistence after compromise
• Weak account recovery guarantees

Kodem intelligence

1. What is GHSA-59FH-9F3P-7M39? GHSA-59FH-9F3P-7M39 is a medium-severity security vulnerability in flowise (npm), affecting versions <= 3.1.1. It is fixed in 3.1.2.
2. Which versions of flowise are affected by GHSA-59FH-9F3P-7M39? flowise (npm) versions <= 3.1.1 is affected.
3. Is there a fix for GHSA-59FH-9F3P-7M39? Yes. GHSA-59FH-9F3P-7M39 is fixed in 3.1.2. Upgrade to this version or later.
4. Is GHSA-59FH-9F3P-7M39 exploitable, and should I be worried? Whether GHSA-59FH-9F3P-7M39 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether GHSA-59FH-9F3P-7M39 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix GHSA-59FH-9F3P-7M39? Upgrade flowise to 3.1.2 or later.