This vulnerability in FlowiseAI Flowise (up to version 3.0.12) involves the verify function within the account service endpoint, leading to potential information disclosure. Remote attackers can exploit this flaw without privileges or user interaction, but the attack complexity is high, making exploitation difficult. The vulnerability has been publicly disclosed with an available exploit, but no official patch or remediation level has been confirmed. The CVSS 4.0 vector indicates network attack vector, high complexity, no privileges required, no user interaction, and low impact on confidentiality with no impact on integrity or availability.

Successful exploitation results in information disclosure, potentially exposing sensitive data handled by the verify function in the account service. The impact is limited to confidentiality with low severity, and no integrity or availability impacts are reported. The high attack complexity reduces the likelihood of widespread exploitation despite the public availability of an exploit.

No official patch or remediation has been confirmed at this time. Users should monitor vendor advisories for updates and apply upgrades once a fix is released. Until then, consider limiting exposure of the affected service to untrusted networks to reduce risk.