CVE-2026-90535
6.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Summary
Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting requests with known chatflow and chat identifiers, causing targeted service disruption.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| FlowiseAI | Flowise | 0 < 3.1.4 | affected |
| FlowiseAI | Flowise | 3.1.4 | unaffected |
Weaknesses
- CWE-862: Missing Authorization
References
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-xhxx-56g3-mx2r
- https://www.vulncheck.com/advisories/flowise-before-3.1.4-denial-of-service-via-text-to-speech-abort
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.