CVE-2026-90535 — Flowise before 3.1.4 Denial of Service via text-to-speech/abort
Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and c…
Published: 2026-09-12 · CVSS: 6.3 · CVSS 4.0
Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting requests with known chatflow and chat identifiers, causing targeted service disruption.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7