Flowise UI allows authenticated users to change their account password without verifying the current password or performing additional authorization checks. This vulnerability enables an attacker with any authenticated session to change the password and take over the account. The flaw affects versions prior to 3.0.10 and has been fixed in version 3.0.10. The impact includes full account takeover, compromising confidentiality and integrity of user data.