CVE-2026-73603 — Flowise before 3.1.4 Credential Abuse via Text-to-Speech
Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, allowing attackers to abuse private chatflow TTS credentials. Unauthen…
Published: 2026-08-13 · CVSS: 6.3 · CVSS 4.0
Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, allowing attackers to abuse private chatflow TTS credentials. Unauthenticated attackers can generate unlimited text-to-speech audio using stored OpenAI or ElevenLabs API keys by providing a valid chatflow UUID, incurring costs on the chatflow owner's account.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7