Is CVE-2025-71337 actively exploited?

No active exploitation of CVE-2025-71337 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2025-71337 be exploited remotely?

Yes. CVE-2025-71337 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2025-71337?

CVE-2025-71337 has a CVSS score of 8.3 (HIGH).

HOME VULNERABILITIESCVE-2025-71337

HIGH

CVE-2025-71337

CWE-620Published: June 23, 2026· Updated: Jun 25, 2026

8.3

CVSS v3.1

EPSS:0.27%probability of exploitation in 30 daysPercentile:19.1th

Official Description

Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email change vulnerability. An authenticated user can change the account email address, used as a login identifier and password-recovery channel, via the account profile endpoint without confirming the change to the original email address or re-entering the current password. By changing the recovery email, an attacker can take over the account and abuse password reset mechanisms.

NVD Source

Technical Analysis

CVE-2025-71337 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 8.3.