Description
Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting requests with known chatflow and chat identifiers, causing targeted service disruption.
Published: 2026-09-12
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch
AI Analysis

Impact

Flowise versions prior to 3.1.4 expose an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint (CWE-862). The endpoint accepts user-supplied chatflowId and chatId without verifying the caller’s ownership of the associated resources. An attacker can submit crafted requests and terminate active chatflow predictions for any user, leading to targeted service disruption and loss of availability for the affected chat sessions.

Affected Systems

FlowiseAI’s Flowise product is affected. All releases before version 3.1.4 are vulnerable. Clients running these versions should until the vulnerability is remedied (inferred).

Risk and Exploitability

The CVSS score of 6.3 places this issue in the medium severity range. The EPSS score is below 1%, indicating a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred, as no authentication is required to reach the endpoint. An attacker can issue HTTP requests to the abort endpoint and force the termination of any user’s active prediction.

Generated by OpenCVE AI on September 15, 2026 at 18:12 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor released patch that updates Flowise.
  • If an immediate patch is not feasible, restrict access to the /api/v1/text-to-speech/abort endpoint by firewall rules or reverse‑proxy authentication until the update is applied.
  • Implement ownership verification for chatflowId and chatId parameters, ensuring that only the creator of a chat or rate‑limiting abort requests in the gateway or load balancer to reduce the impact of potential abuse.

Generated by OpenCVE AI on September 15, 2026 at 18:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 15 Sep 2026 19:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Mon, 14 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 12 Sep 2026 12:30:00 +0000

Type Values Removed Values Added
Description Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting requests with known chatflow and chat identifiers, causing targeted service disruption.
Title Flowise before 3.1.4 Denial of Service via text-to-speech/abort
First Time appeared Flowiseai
Flowiseai flowise
Weaknesses CWE-862
CPEs cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*
Vendors & Products Flowiseai
Flowiseai flowise
References
Metrics cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Flowiseai Flowise
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-14T16:04:39.559Z

Reserved: 2026-09-12T11:12:50.791Z

Link: CVE-2026-90535

cve-icon Vulnrichment

Updated: 2026-09-14T16:04:34.976Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-12T13:16:51.380

Modified: 2026-09-15T19:07:20.020

Link: CVE-2026-90535

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-15T18:15:11Z

Weaknesses