This vulnerability in FlowiseAI Flowise (up to version 3.0.12) involves an information disclosure flaw in the Login function of the API Response Handler (file packages/server/src/enterprise/services/account.service.ts). The flaw can be exploited remotely but requires high attack complexity and no privileges or user interaction. The CVSS 4.0 base score is 6.3 (medium severity), reflecting limited impact and difficult exploitability. No vendor advisory or patch information is currently available, so remediation status is unknown.

Successful exploitation could lead to unauthorized disclosure of information via the Login function in the API Response Handler. The impact is limited to information disclosure without privilege escalation or integrity/availability impact. Exploitation is difficult and requires high complexity, reducing the likelihood of widespread exploitation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor FlowiseAI communications for updates and apply any official patches once available. Until then, consider restricting access to the affected service to trusted networks if possible.