Flowise prior to version 3.1.0 exposes a text‑to‑speech endpoint that is publicly accessible and accepts a credentialId in the request body. The service uses this identifier to decrypt stored credentials, such as those for OpenAI or ElevenLabs, enabling the caller to generate speech and consume the associated third‑party API credit. This mechanism allows an attacker to abuse a victim’s API usage without requiring legitimate authentication, representing a credential abuse weakness (CWE‑639).

Vulnerable instances run any Flowise version before release 3.1.0. The issue was fixed in 3.1.0 and the endpoint was secured starting with that version.

Based on the description, it is inferred that an attacker can reach the whitelisted endpoint from any network and submit a valid credentialId value. The likely attack vector is sending a POST request to POST /api/v1/text-to-speech/generate with a credentialId in the request body. Because the endpoint requires no authentication, the attack surface is large, and the CVSS score of 8.2 underscores the potential cost impact. The EPSS score of less than 1% indicates that exploitation is currently rare, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the financial impact to the owner of the stored credentials remains significant if the endpoint is abused. Implementing authentication or restricting the endpoint to trusted networks mitigates the risk by eliminating the unauthenticated entry point.