CVE-2026-90535

EUVD-2026-76853
Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting requests with known chatflow and chat identifiers, causing targeted service disruption.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 41.36%
Affected Products (NVD)
VendorProductVersion
flowiseaiflowise
𝑥
< 3.1.4
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-xhxx-56g3-mx2r
https://www.vulncheck.com/advisories/flowise-before-3.1.4-denial-of-service-via-text-to-speech-abort
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-xhxx-56g3-mx2r