Flowise: Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the…
Flowise
More for Flowise RSS feed for Flowise
- Severity
- High, CVSS 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Record
- CVE-2026-90535
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- September 12, 2026
- Source last modified
- September 15, 2026
Description
Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting requests with known chatflow and chat identifiers, causing targeted service disruption.
Description quoted from the NVD record.
Who is affected
Flowise is a tool for building apps and chatbots that use AI language models. This flaw affects Flowise versions before 3.1.4. It sits in the part of the text-to-speech feature used to stop a response in progress. That part does not check who is asking, so anyone who knows the identifiers of a particular chatbot and conversation can cut off responses that chatbot is giving to any user, without logging in. This can disrupt your chatbot service for chosen users or conversations. This flaw is rated High.
What to do
- If someone in your organization installed or runs Flowise, that person should act on this advisory. If an IT provider or vendor runs it for you, send them this advisory and ask when the update will be done.
- Find out which version of Flowise you are running. Any version before
3.1.4is affected. - Update Flowise to version
3.1.4or later, which fixes this flaw. - If you need help with the update, check the vendor advisory linked on this page for details on the fixed release.
Analysis written from the source record as of September 15, 2026 and reviewed before publishing.