CVE-2026-90535CWE-862broken-access-control

CVE-2026-90535

High · published September 12, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
40.6
In the wild
Unconfirmed
What it is

Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting requests with known chatflow and chat identifiers, causing targeted service disruption.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
6.3 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00482 · 40.6th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-12T17:16Z
Affected products (1)
ProductVersionsFixed in
flowiseai/flowise< 3.1.43.1.4
References (3)
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-xhxx-56g3-mx2r · [email protected]https://www.vulncheck.com/advisories/flowise-before-3.1.4-denial-of-service-via-text-to-speech-abort · [email protected]https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-xhxx-56g3-mx2r · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 14 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 12 SEP 12:08Z
    Flowise before 3.1.4 Denial of Service via text-to-speech/abort
    cvelistv5