Flowise: Mass Assignment in PUT /api/v1/user Allows Authenticated Users to Override Password Hash and Bypass Password Change Verification

Summary

A Mass Assignment vulnerability in the PUT /api/v1/user endpoint allows authenticated users to directly modify restricted user fields, including the credential (password hash), bypassing the intended password change workflow.

Because the endpoint forwards the entire request body to the service layer without filtering, an attacker can override the credential field without providing the current password.

This bypasses several security protections including:

• old password verification
• password hashing enforcement
• password policy validation
• session invalidation on password change

While the vulnerability cannot be used to modify other users due to an ID check in the controller, it allows attackers who obtain a temporary session (e.g., via token theft or XSS) to establish persistent account access.

Details

The endpoint PUT /api/v1/user allows authenticated users to update their user profile.

The controller checks that the authenticated user matches the provided id, preventing direct IDOR:

const currentUser = req.user
const { id } = req.body

if (currentUser.id !== id) {
    throw new InternalFlowiseError(StatusCodes.FORBIDDEN)
}

However, the controller forwards the entire request body directly to the service layer without filtering:

const user = await userService.updateUser(req.body)

Inside UserService.updateUser, the incoming data is merged into the existing user entity:

updatedUser = queryRunner.manager.merge(User, oldUserData, newUserData)

Because newUserData is derived from req.body and there is no field allowlist, any field present in the User entity may be modified.

This includes sensitive fields such as:

• credential
• tempToken
• tokenExpiry
• status
• email

The service implements a secure password change workflow that requires the following fields:

oldPassword
newPassword
confirmPassword

Example code:

if (newUserData.oldPassword && newUserData.newPassword && newUserData.confirmPassword) {
    if (!compareHash(newUserData.oldPassword, oldUserData.credential)) {
        throw new InternalFlowiseError(StatusCodes.BAD_REQUEST)
    }

    newUserData.credential = this.encryptUserCredential(newUserData.newPassword)
}

However, this logic can be bypassed by directly supplying a credential value in the request body.