Description
Flowise before 3.1.2 sets Access-Control-Allow-Origin to a hardcoded wildcard (*) on its text-to-speech (TTS) generation endpoint (packages/server/src/controllers/text-to-speech/index.ts), independent of the server's configured CORS policy. This bypasses the server's otherwise restrictive default CORS configuration (getCorsOptions()) and allows any webpage to make cross-origin requests that trigger TTS generation using stored credentials, enabling drive-by cross-origin credential abuse.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Flowise | Flowise | < 3.1.2 | 3.1.2 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | flowise | < 3.1.2 | 3.1.2 | GHSA-m837-xvxr-vqwg |
Advisories 1
- WID-SEC-2026-1554 Flowise: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Jun 30, 2026
References
- GitHub Security Advisory (GHSA-m837-xvxr-vqwg) vendor-advisory
- VulnCheck Advisory: Flowise - Hardcoded CORS Wildcard in TTS Endpoint third-party-advisory