CVE-2026-90535
Flowise before 3.1.4 Denial of Service via text-to-speech/abort
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting requests with known chatflow and chat identifiers, causing targeted service disruption.
| CWE | CWE-862 |
| Vendor | flowiseai |
| Product | flowise |
| Published | Sep 12, 2026 |
| Last Updated | Sep 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for flowiseai flowise
Be the first to know when new unknown vulnerabilities affecting flowiseai flowise are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
FlowiseAI / Flowise
0 < 3.1.4
References
Credits
🔍 offset