Flowise: Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech…
Flowise
More for Flowise RSS feed for Flowise
- Severity
- Medium, CVSS 5.3
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Record
- CVE-2026-73603
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 13, 2026
- Source last modified
- October 24, 2026
Description
Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, allowing attackers to abuse private chatflow TTS credentials. Unauthenticated attackers can generate unlimited text-to-speech audio using stored OpenAI or ElevenLabs API keys by providing a valid chatflow UUID, incurring costs on the chatflow owner's account.
Description quoted from the NVD record.