Flowise UI versions prior to 3.0.10 allow users to change their account email address without verifying the requester's authority, such as confirming via the old email or requiring authentication. Since the email serves as a login identifier and password recovery channel, this flaw enables attackers to take over accounts by changing the recovery/login email unverified. This vulnerability can lead to full account takeover, compromising confidentiality and integrity of user data.